Technical impact
A race condition in the Windows Win32K graphics subsystem allows a local attacker who already has authorized access to execute code with higher privileges. The flaw is caused by improper synchronization of concurrent operations on a shared resource, resulting in a use‑after‑free scenario. An attacker could elevate their privileges beyond the user context, potentially gaining administrative rights on the compromised machine.
Affected Systems
Affected releases include Microsoft Windows 10 versions 1809, 21H2, and 22H2; Microsoft Windows 11 versions 24H2, 25H2, and 26H1; Microsoft Windows Server 2019 (both standard and Server Core installations); Microsoft Windows Server 2022; and Microsoft Windows Server 2025 (both standard and Server Core installations).
Risk and Exploitability
The CVSS score of 7.8 indicates a high severity vulnerability. The EPSS score of < 1% suggests that exploitation is currently unlikely and the flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack vector requires local, authorized access; an attacker would need to trigger the race condition by manipulating concurrent operations within the Win32K subsystem. Successful exploitation would grant elevated local privileges, enabling further persistence or lateral movement.
