Windows Hello contains a race condition caused by improper synchronization of a shared resource during concurrent execution. This flaw allows an authorized local attacker to elevate privileges, effectively granting elevated access within the Windows environment. The weakness is classified as CWE-362, which captures this kind of synchronization error.

Microsoft Windows 10 Version 21H2, Windows 10 Version 22H2, and multiple Windows 11 releases – 23H2, 24H2, 25H2, and 26H1. These operating systems have been identified as vulnerable, and the issue remains present across all noted configurations.

The CVSS score of 7.8 indicates a high severity, while the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog. The problem can be exploited only by an authorized local user, as the race condition arises during Windows Hello authentication. No public exploit is known, but the potential for local privilege elevation and subsequent impact on system integrity is significant.