A race condition in the Microsoft Account subsystem allows an attacker who already has local user authority to manipulate a shared resource due to improper synchronization. The flaw enables the attacker to gain elevated privileges on the same system, effectively bypassing normal privilege boundaries. This vulnerability is classified as CWE‑362 and CWE‑416 and carries a CVSS score of 7, indicating a moderate to high severity for any affected user.

The flaw affects a wide range of Microsoft Windows products, including Windows 10 versions 1607, 1809, 21H2, 22H2 and Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, as well as Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, 2025 and their Server Core variants. All operating systems listed in the CNA vendor–product table are susceptible, and no specific version exclusions are provided.

With a CVSS score of 7, the vulnerability presents a significant risk to local accounts. Although EPSS data is unavailable and the vulnerability is not yet listed in the CISA KEV catalog, the attack vector is inferred to require local or remote access that grants the attacker user‑level privileges. Once the race condition is triggered, the attacker can elevate privileges, potentially compromising the entire host. Given the lack of public exploitation data, the likelihood of immediate exploitation remains uncertain but the severity warrants prompt attention.