The flaw is a race condition that arises when concurrent processes access a shared resource in Windows Runtime without proper synchronization. This weakness, identified as CWE-362 and CWE-416, can be manipulated by an attacker who can initiate crafted network traffic against the target system, allowing the attacker to execute actions with higher privilege than the user context normally permits.

Affected operating systems include Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; Windows Server 2019 (both standard and Server Core installations); Windows Server 2022; and Windows Server 2025.

The vulnerability carries a CVSS score of 8.1, indicating high severity, while the EPSS score is less than 1%, suggesting a low probability of exploitation at the current time. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves a remote network actor capable of sending specially crafted requests to the affected Windows Runtime component, exploiting the race condition to gain elevated privileges. The conditions for a successful exploitation require concurrent access to the vulnerable resource, which can be triggered by network traffic from an unauthorized source.