A race condition (CWE‑362) combined with a use‑after‑free (CWE‑416) in Windows Media allows an authorized attacker to trigger improper synchronization of shared resources during concurrent execution, resulting in an elevation of privileges. The flaw enables the attacker to gain higher system rights than intended, potentially compromising system integrity.

Microsoft Windows 11 Version 24H2 (ARM64), Version 25H2 (ARM64), and Version 26H1 (x64) are impacted. No other Windows 11 releases are mentioned as affected.

The CVSS score of 7.5 reflects a moderately high risk for the affected builds. The EPSS score is < 1%, indicating the likelihood of current exploitation is low. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network‑based and requires the adversary to already have authorized network access to the target machine; by provoking the race condition the attacker can elevate privileges beyond the intended level.