A race condition caused by improper synchronization of a shared resource in the Windows DCOM Server allows an authorized local attacker to elevate privileges. The flaw enables concurrent requests that bypass normal privilege checks, effectively raising the attacker’s permissions to that of a system administrator. The vulnerability does not provide a remote exploitation path; it requires local presence of an authorized user.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 (arm64), and 26H1 (x64); Microsoft Windows Server 2012 (including core), 2012 R2, 2016, 2019, 2022, and 2025 (including core installations) across x86, x64, and arm64 architectures.

The CVSS base score of 7 indicates a high risk for affected systems that are locally reachable. The EPSS score of less than 1 percent suggests a very low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is local, requiring an authorized user with physical or remote shell access to trigger the race condition.