Technical impact
A race condition in the Windows Clip Service creates an improper synchronization gap when multiple processes access a shared resource concurrently, allowing a locally authorized user to elevate privileges. The flaw, documented as CWE‑362 (Race Condition) and CWE‑416 (Use After Free), can result in execution of code with higher rights, potentially compromising the entire system. No remote exploitation is possible; the attacker must have local access to the machine.
Affected Systems
Operating systems affected include Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; and Windows Server editions 2019, 2022, and the forthcoming 2025, in both full and Server Core configurations. These span client and server environments, covering x86, x64, and ARM64 platforms where applicable.
Risk and Exploitability
The CVSS score of 7 indicates high severity. With an EPSS score of less than 1%, exploitation is currently deemed unlikely, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local user authorization and the ability to influence or invoke the Clip Service, making the most probable attack vector the execution of a malicious payload by an authenticated user or through a privileged application that interacts with the service.
