Windows Performance Monitor contains a race condition that occurs when multiple process instances access a shared resource without proper synchronization. The flaw allows an attacker who already has local user access to manipulate the timing of operations, causing the monitor to execute privileged actions on their behalf. This can result in the attacker elevating their rights to a higher privilege level, potentially enabling them to install software, modify system settings, or otherwise compromise the integrity and confidentiality of the system. The vulnerability is categorized as CWE-362.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 (duplicate), and 26H1; Windows 11 ARM64 version 26H2; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core installations. The affected systems include both x86 and x64 architectures as indicated by the CPE entries.

An attacker who can run code with local user privileges can trigger the race condition by launching concurrent Performance Monitor processes or by submitting specially crafted requests. The flaw requires no network exposure, so the attack vector is local. The CVSS score of 6.7 indicates a medium severity, and because the EPSS value is unavailable, the exploitation likelihood cannot be precisely quantified, but no listing in the CISA KEV catalog suggests no widespread exploitation at this time. However, the presence of the race condition means that any authenticated user could potentially elevate privileges, making it a high‑impact concern for environments with increased local access.