This vulnerability is a race condition caused by concurrent execution using a shared resource in the Windows Search component. An attacker who already has local user privileges can manipulate the timing of operations to cause the component to perform actions with higher rights, effectively elevating their privileges to an administrator level. The flaw is an improper synchronization mechanism that allows the attacker to control the execution order of operations, thereby bypassing normal security checks. The impact is a local privilege escalation that could enable the attacker to modify system settings, install software, or compromise network resources.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and 23H2; Microsoft Windows Server 2012 R2 (including Server Core), 2016 (including Server Core), 2019 (including Server Core), 2022, and 2025 (including Server Core). Every listed product contains the vulnerable Windows Search component.

The CVSS score of 7 indicates a medium–high level of severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed exploits yet. The attack requires a local account with authorization to execute code. Once the race condition is triggered, the attacker can gain elevated privileges system-wide, potentially allowing widespread compromise. Because the vector is local, the attacker must have physical or logical access to the affected system.