A race condition exists in Windows Security Center when multiple processes access a shared resource without proper synchronization. This flaw, identified as CWE-362 and CWE-416, allows an attacker who already has authorized local access to gain elevated privileges on the same machine. Based on the description, it is inferred that the impact is limited to the local scope, enabling the attacker to execute privileged commands or modify system settings that normally require higher authority.

The vulnerability affects Microsoft Windows 11 operating systems: 24H2, 25H2, and 26H1. In the 24H2 and 25H2 releases the flaw exists on arm64 architectures; in the 26H1 release it exists on x64 architectures. All affected builds should be considered at risk if no remediation is applied.

With a CVSS score of 6.4 the severity is moderate. No EPSS score is available and the issue is not currently listed in the CISA KEV catalog, indicating limited public exploitation. Based on the description, it is inferred that the attack vector is local, requiring the attacker to have some level of authorized access to the system. Based on the description, it is inferred that exploitation requires precise timing to trigger the race condition, but the lack of known public exploits suggests that the practical risk is lower than the base severity would indicate, though the vulnerability is still actionable.