A race condition caused by concurrent operations on a shared resource in the Windows Runtime, due to missing proper synchronization, produces a use‑after‑free scenario. An authorized local attacker can trigger this condition to alter execution flow or memory, allowing the process owning the credentials to be swapped for a higher‑privileged token. This grants the attacker administrative or system privileges on the compromised machine, while the vulnerability cannot be exploited remotely. The weakness is captured by CWE‑362 and CWE‑416.

Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; Windows Server 2019 (including Server Core), Windows Server 2022, and Windows Server 2025 (including Server Core). All affected builds use the Windows Runtime component that implements the vulnerable shared resource logic.

The CVSS score of 7.8 classifies the vulnerability as high severity, whereas the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The attack vector is local; an authenticated user who can execute code and interact with the Windows Runtime API is required. The vulnerability is not listed in CISA’s KEV catalog, suggesting limited known widespread exploitation.