A race condition exists in the Windows NTFS file system due to improper synchronization. The flaw allows an attacker who already has local access to perform concurrent operations on a shared resource and gain elevated privileges, potentially reaching system or administrative level. The weakness is a classic race condition and a use‑after‑free, each classified as CWE-362 and CWE-416.

The vulnerability affects a wide range of Microsoft operating systems: Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2 through 26H2 (including 26H1), and Windows Server builds from 2012 to 2025, including both regular and Server Core installations. The affected architectures include x86, x64, and arm64 where listed.

The CVSS score of 7.0 places it in the high‑severity class, but the EPSS score is not available, making it difficult to gauge current exploitation activity. The vulnerability is listed as not in the CISA KEV catalog, suggesting no public exploitation is known. The likely attack vector is local; an authenticated user on the target machine must initiate the race condition, typically through privileged NTFS operations. No publicly documented exploit or remote trigger is indicated in the CVE data.