This vulnerability is a race condition that occurs when multiple processes access shared resources within Windows Storage. The lack of proper synchronization allows an attacker who already has local access to execute privileged operations. The attacker can gain higher privileges than intended, potentially compromising system integrity and confidentiality.

The flaw affects a broad range of Microsoft Windows operating systems, including Windows 10 versions 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, Windows Server 2019 (including Server Core), Server 2022, and Server 2025 (including Server Core). Any installation of these OS releases that contains the default Windows Storage components is susceptible, particularly when running on both x86, x64, and ARM64 architectures.

The vulnerability has a CVSS score of 7.0, indicating a high severity. No EPSS value is available, and it is not currently listed in the CISA KEV catalog, so the exploitation probability is not quantified but remains potentially high for target‑specific attacks. Inferred from the description, the attack vector is local and requires the attacker to be authenticated with regular user rights; therefore, the exploit does not rely on network exposure but rather on the existence of a local user with sufficient privileges.