Windows Shell CVE-2025-64661

Requires the attacker to already have authenticated low-privileged local access to the Windows host (AV:L, PR:L) and to execute code that triggers the vulnerable Windows Shell code path. Exploitation is limited by high attack complexity (AC:H): success depends on winning a race-condition timing window against a concurrent privileged operation on a shared resource, which is non-deterministic and typically requires many attempts. No user interaction is required (UI:N). No special non-default configuration is indicated - the affected Windows Shell component is present by default on all listed Windows client and server versions. There is no remote or unauthenticated exploitation path.

This is a locally-exploitable, authenticated elevation-of-privilege flaw whose real-world risk sits below what the 7.8 HIGH score suggests in isolation. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) shows the severity is driven by scope change (S:C) plus full CIA impact, but two metrics constrain exploitability: it requires local access with existing low privileges (AV:L, PR:L), and high attack complexity (AC:H) reflecting the timing/TOCTOU nature of a race condition that an attacker must reliably win. No EPSS score, no CISA KEV listing, and no public PoC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' Microsoft (the reporter) publishes only an advisory-level MSRC note with no technical detail, no SSVC decision fields, and no exploitability assessment. Net: a genuine EoP primitive in a ubiquitous component, but the local + authenticated + race-window prerequisites make it a patch-in-normal-cycle item rather than an emergency, absent evidence of active exploitation. Note also the input tag 'Information Disclosure' contradicts the description, which explicitly states privilege elevation - treat the impact as EoP, not info-disclosure.

A low-privileged local user (or malware already running in a standard user context) runs a program that repeatedly triggers the vulnerable Windows Shell operation and races a shared resource against a privileged operation, winning the timing window to manipulate state and execute code or actions at higher privilege. Because attack complexity is high, the attacker likely loops the exploit many times to reliably win the race. No public exploit code is identified in the available data.