The Windows Embedded Mode Service contains a race condition caused by improper synchronization of shared resources. An authorized local user can exploit this flaw to gain higher privileges. The impact is local privilege escalation, potentially allowing system‑wide access if the attacker successfully elevates. This weakness is identified as CWE-362.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Microsoft Windows Server 2016, 2019, 2022, and 2025, including both standard and Server Core installations. All these editions are vulnerable to the race condition in the Embedded Mode Service.

The vulnerability has a CVSS score of 7, indicating a high severity. The EPSS score is not disclosed, and the flaw is not listed in the CISA KEV catalog. The attack vector is inferred to be local; an authorized user must already have some level of access to the system to trigger the race condition. Given the high severity, the risk is significant for environments where the Embedded Mode Service is enabled and local users could exploit the flaw.