This vulnerability originates from a time‑of‑check to time‑of‑use race condition in the Reliable Multicast Transport Driver (RMCAST). The flaw allows an attacker who already has limited local access to gain elevated privileges through improper handling of buffer sizes and race conditions, which corresponds to CWE‑122 (Buffer Manipulation) and CWE‑367 (Race Condition). The exploit does not require network access and can be triggered by local user privileges.

The flaw affects multiple Microsoft Windows releases, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and several Server editions such as Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, both full and server‑core installations. These include x86, x64, and arm64 architectures as listed in the vendor documentation.

The CVSS score of 7.0 places the vulnerability in the high severity range. EPSS data is not available, so the exploitation likelihood cannot be quantified, and the vulnerability is not listed as a Known Exploited Vulnerability in the CISA catalog. Attackers would need to have local access with some level of administrative or user privileges to trigger the race condition; therefore, the attack surface is limited to the local machine or a compromised user session.