The vulnerability arises from a race condition caused by improper synchronization of shared resources during concurrent execution within the Microsoft Windows App Store. This flaw allows an attacker who already has local user access to avoid normal permission checks and obtain higher privileges. The weakness is classified as CWE‑362, a classic race condition, and enables the attacker to elevate privileges locally, potentially reaching SYSTEM privileges.

Affected systems include Microsoft Windows 10 releases 1607, 1809, 21H2, and 22H2; Windows 11 releases 24H2, 25H2, and 26H1; and Windows Server releases 2016, 2019, 2022, and 2025, including Server Core installations. The flaw exists on both x86 and x64 architectures and on ARM64 for Windows 11 24H2 and 25H2.

The CVSS score of 7 indicates a moderate to high severity. The EPSS score of <1% suggests exploitation is unlikely in the wild, and the vulnerability is not listed in the CISA KEV catalog. A local attacker with valid credentials can trigger the race condition, potentially capturing an elevated privilege token. Because it requires concurrent use of the App Store, it is a local attack that does not necessarily need compromised credentials beyond those already in use.