The vulnerability exists in the Windows Telephony Service where concurrent execution on a shared resource is improperly synchronized, resulting in a race condition that allows an authenticated local user to gain elevated privileges. The flaw is identified as Race Condition (CWE‑362) and potentially Use‑After‑Free (CWE‑416), which can lead to privilege escalation. The attacker can exploit the race condition by triggering two simultaneous processes that manipulate the service's internal state in a conflicting order, effectively hijacking control of the service and causing it to run with SYSTEM privileges. This escalation can provide the attacker with full control over the affected system, enabling arbitrary code execution, data modification, and system compromise.

Affected products include various releases of Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H1) for both x86, x64, and ARM64 architectures, as well as Windows Server editions from 2012 through 2025, including Server Core variants. The list covers both desktop and server environments, meaning any installation of these Windows families that still runs the Telephony Service is at risk.

The CVSS score of 7 indicates moderate severity, and the EPSS score of <1% indicates a very low but nonzero exploitation probability. The vulnerability has not yet been reported in the CISA Known Exploited Vulnerabilities (KEV) catalog, suggesting no publicly documented exploits at present. Based on the description, it is inferred that the attack requires local authenticated access, so an attacker must already have a user account on the target system to trigger the race condition.