A race condition in Windows Runtime arises when concurrent execution accesses a shared resource without proper synchronization. The flaw can let an authorized local attacker gain higher privileges than intended, potentially compromising system integrity or enabling further attacks. The weakness is a concurrency flaw, identified as CWE-362, and may involve improper memory handling, as noted by CWE-416.

The vulnerability affects Microsoft Windows 11 versions 24H2, 25H2, and 26H1, as well as Windows Server 2025, including Server Core installations. Users on these builds are impacted unless a fix has been applied.

The CVSS score of 7 indicates a high severity local privilege escalation. The EPSS score, being less than 1%, suggests a very low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that exploitation would require an attacker to have a valid local account and sufficient permissions to execute competing threads or processes to trigger the race condition, making the attack vector local.