The Windows Connected Devices Platform Service contains a race condition and improper memory handling that allow a locally‑attached, authorized user to gain higher privileges. The flaw is caused by a concurrent execution using a shared resource without proper synchronization, leading to a change in privilege level. The vulnerability is classified under CWE‑362 and CWE‑416.

Affected Windows 10 builds 1809, 21H2, and 22H2, Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1, as well as Windows Server 2019, 2022, and 2025 (both standard and Server‑Core installations).

The CVSS score of 7.0 indicates a high severity. The EPSS score is not available, so the exact exploitation probability is unclear, but the flaw is only exploitable by users who already have local access and can execute code in the context of the service. The vulnerability is not listed in the CISA KEV catalog, which suggests no publicly known exploitation, yet the local privilege escalation potential warrants immediate attention. An attacker could use the race condition to manipulate memory in the service process, elevating privileges to system or administrative level for subsequent attacks.