The vulnerability is a time‑of‑check, time‑of‑use race condition in the Microsoft Servicing Stack Updates component, identified as CWE‑367. It allows a local user who can trigger an update to race the installer against privileged‑account creation or secure‑object modification routines, enabling exploitation of a privilege‑escalation path that can increase the attacker’s privileges on the host. The flaw is limited to local authenticated users and does not require remote code execution or system compromise.

Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2 and the 26H1 release, as well as Windows Server 2025 (Server Core). The affected updates are delivered for x64 and arm64 architectures, as indicated by the supplied CPE strings.

The CVSS score of 7 categorizes this flaw as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so no publicly confirmed exploits exist at this time. Exploitation requires local authenticated access and the ability to initiate a Servicing Stack Update, which is typically confined to users with administrative rights or the ability to execute update files. When the race condition is successfully triggered, the attacker can elevate privileges, potentially compromising system integrity.