A race condition in the Windows Win32K graphics subsystem occurs when concurrent operations on a shared resource are improperly synchronized. Classified as CWE‑362, the flaw permits a local attacker with authorized access to manipulate execution ordering and elevate privileges, moving from a standard user to an administrator or system account without remote exploitation. This compromise threatens system integrity and confidentiality.

Affected systems include Microsoft Windows 10 versions 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1, 26H2; and Windows Server editions 2019, 2022, 2025, including their Server Core installations. All listed releases contain the vulnerable Win32K component and have not yet received a fix for this vulnerability.

The CVSS score of 7.0 indicates high severity, yet the EPSS score is not available and it is not listed in the CISA KEV catalog. The attack vector is local: an attacker must already possess a legitimate or compromised local account to trigger the race condition. Once triggered, the attacker can acquire elevated privileges, presenting a significant risk to affected environments with potential for system‑wide compromise.