A race condition in the Windows Win32K subsystem allows an attacker who is already authorized on the local machine to bypass a security feature. The flaw arises from improper synchronization when multiple threads access a shared resource, and a determined user can exploit it to change the behavior of the operating system, potentially enabling them to gain elevated privileges or perform actions beyond the intended security boundaries.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1; Microsoft Windows Server 2016, 2019, 2022, 2025 (all editions); including Server Core installations of Server 2016, 2019, and 2025.

The CVSS score of 4.7 indicates moderate risk. EPSS data is unavailable, so the current exploitation probability cannot be quantified. The vulnerability is not listed in CISA KEV, suggesting no known large-scale exploitation. Exploitation requires a local, authorized attacker and relies on the failure to enforce proper synchronization in the Windows kernel, which limits the attack surface to any user with the ability to run code on the affected machine.