Concurrent execution using a shared resource with improper synchronization, known as a race condition, in Windows Hello lets an authorized local attacker elevate privileges. The flaw allows the attacker to gain elevated rights on the same system without remote access, potentially gaining full control over the device.

Microsoft Windows 10 versions 21H2 and 22H2, and Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 26H1 are affected, as identified by the CNA vendors list.

The CVSS score of 7.5 indicates a moderate-to-high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, involving an authorized user or process that can trigger concurrent access to the shared resource used by Windows Hello. Exploitation requires no special privileges beyond the victim user's session and can result in system-wide privilege escalation.