The Windows Phone Service contains a race condition that allows concurrent access to a shared resource without proper synchronization. Because the service runs with elevated privileges, an attacker who can launch two concurrent requests can manipulate the order of operations and gain higher privileges. The flaw is classified as CWE-362 and also involves a potential use‑after‑free (CWE-416). The result is local privilege escalation that can enable the attacker to obtain administrative rights on the compromised machine.

Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1 on both ARM64 and x64 architectures, as well as Microsoft Windows Server 2022. The vulnerability is present in all these releases; it is inferred that it is only exploitable when the Windows Phone Service is installed and actively running.

The CVSS score of 7.0 indicates a high severity impact. EPSS shows an exploitation likelihood of less than 1 %. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local: it requires the attacker to have authorized local access and to start two processes that interact with the Windows Phone Service simultaneously. Because the flaw arises from improper synchronization, it is generally difficult to trigger without the ability to send concurrent service requests, which limits the exposure to environments where the attacker can run privileged code. It is inferred that the Windows Phone Service must be installed and running for exploitation to be possible.