A race condition exists within the Windows Media component that arises during concurrent execution of a shared resource. The improper synchronization allows an attacker with local or authenticated access to trigger a sequence that results in a use‑after‑free condition, identified as CWE-362 and CWE-416. If successfully exploited, the attacker can run processes with higher security clearance, potentially compromising the entire system.

Microsoft Windows 11 versions 24H2, 25H2, and 26 H1 are affected. Versions 24H2 and 25H2 are available for arm64 architectures, while 26H1 is delivered for x64 systems.

The CVSS score of 7.0 denotes significant severity, though the EPSS score of less than 1 % suggests a low likelihood of widespread exploitation. It is not listed in the CISA KEV catalog. The attack vector is local, requiring an attacker to be authenticated on the target system or have physical access to execute the privilege escalation scenario.