Technical impact
The Windows LUAFV driver contains a race condition caused by improper synchronization of a shared resource. An attacker who is authenticated on the system can trigger concurrent execution against the driver, which results in a local privilege escalation. The defect is represented by CWE‑362 and CWE‑416, indicating a concurrency error and a use‑after‑free vulnerability. Elevating privileges locally allows the attacker to gain higher rights and potentially compromise the entire machine.
Affected Systems
Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations. All affected systems run the LUAFV driver and are vulnerable to the race condition if a local user can access it.
Risk and Exploitability
The CVSS score of 7 indicates moderate severity, and the EPSS score of less than 1% shows a very low probability of exploitation at this time. The vulnerability is not listed in the U.S. CISA KEV catalog, suggesting that no known public exploits exist. However, because it allows a local authenticated user to gain full control of the machine, the potential impact is high. The attacker must be able to invoke the race condition on the driver, but no special hardware or elevated privileges are required beyond local authentication.
