Windows Credential Manager contains a race condition and a use‑after‑free vulnerability (CWE‑362, CWE‑416) caused by concurrent execution of shared resources without proper synchronization. An attacker who already has local access can exploit this flaw to raise privileges by creating a timing mismatch, allowing them to execute privileged operations that are normally restricted.

The vulnerability affects Microsoft Windows operating systems, including Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, 2025, with both full and Server Core installations covered.

The CVSS base score is 7, indicating a high severity for a local privilege escalation scenario. No EPSS data is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that known exploitation rates are uncertain. Given that the attack requires a legitimate local account and a race condition exploit, the likelihood of successful exploitation is moderate but cannot be excluded in environments where privileged operations rely on Credential Manager.