EUVD-2026-100361
GHSA-m974-5354-c57m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local code execution
-
DeliveryInvoke vulnerable kernel code path concurrently
-
ExploitWin race on shared resource
-
ExecutionCorrupt kernel memory/state
-
ImpactElevate to SYSTEM privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already have authenticated, low-privileged local code execution on the target Windows host (AV:L, PR:L) - there is no remote or unauthenticated path. Exploitation further depends on winning a race condition (CWE-362, AC:H): success requires precise timing against a shared kernel resource, so exploitation is probabilistic and may need many attempts, limiting reliability. No user interaction is required (UI:N). These factors make this a post-compromise privilege-escalation primitive rather than an initial-access vector. |
| Impact | This is a legitimate but moderate-urgency local privilege escalation in the Windows Kernel. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 High) tells a consistent story: an already-authenticated local user with low privileges can elevate to full SYSTEM-level compromise (C:H/I:H/A:H), but only after winning a race condition (AC:H, CWE-362), which raises exploitation effort and reliability costs. No EPSS score was provided, so statistical exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV and no public exploit code was provided in the intelligence, so exploitation status is: no public exploit identified at time of analysis. There is no signal conflict between the CVSS vector and the description - both agree on local, authenticated elevation of privilege. The practical priority is standard Patch-Tuesday urgency: it requires an attacker to already have code execution on the host, so it is a post-compromise escalation primitive rather than an initial-access or wormable threat. Note one metadata discrepancy: the input carries an 'Information Disclosure' tag, but the description and C/I/A=High impact describe privilege elevation, not disclosure - treat the tag as likely mislabeled. |
| Exploit ScenarioDerived | A low-privileged user (or malware running in a standard user context) executes a crafted program that repeatedly triggers the vulnerable kernel code path, racing to manipulate a shared resource during a narrow timing window. On a successful race, the attacker corrupts kernel state to gain SYSTEM privileges, fully compromising the host. No public exploit was identified in the provided data, and the high attack complexity means exploitation may require many attempts to win the race reliably. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Local privilege escalation in the Windows Kernel lets an attacker who already holds authenticated, low-privileged code execution on a Windows host raise their rights to high integrity - typically SYSTEM - by exploiting a race condition in how the kernel synchronizes access to a shared resource. Because the vector is local (AV:L) with low privileges required (PR:L) and high attack complexity (AC:H), this is a post-compromise escalation primitive rather than an initial-access path, and successful exploitation is probabilistic, potentially requiring many timing attempts. No public exploit code has been identified and the CVE is not listed in CISA KEV at time of analysis; no user interaction is needed (UI:N), and the score of 7.0 with C:H/I:H/A:H reflects full loss of confidentiality, integrity, and availability once the race is won.
RemediationAI
The primary fix is to apply the Microsoft kernel security update identified for this CVE in the Microsoft Security Update Guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102207); the input data does not include an exact fix build number, so patch status is best expressed as patch available per vendor advisory, with the precise fixed KB/build to be taken from that advisory, and administrators should expect a reboot because kernel binaries are replaced. Until patching completes, the practical compensations all target the PR:L prerequisite: enforce least privilege so users operate without local administrator rights (trade-off: elevated workflows need a managed process such as Windows LAPS or a just-in-time elevation tool), and deploy WDAC or AppLocker application allowlisting to constrain which binaries can run on high-value hosts (trade-off: significant maintenance overhead and possible breakage of line-of-business or unsigned in-house tooling). Enable Credential Guard and LSASS protection as PPL to limit what a successfully elevated token can steal (trade-off: some third-party authentication or credential-access drivers fail to load), and reduce the number of interactive logon targets on servers. Detection should focus on anomalous local privilege transitions, unexpected token elevation, and unusual kernel-level activity from low-privileged parent processes, since the flaw is only reachable after an attacker already has a foothold - treating this as a post-compromise escalation primitive rather than an entry point is the key to prioritizing response.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 16 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-362, "Concurrent execution using shared resource with improper synchronization," in the Windows kernel. Kernel-mode code frequently touches shared objects - reference counters, handle tables, pool allocations, object manager structures - that must be protected by synchronization primitives such as spinlocks, executive resources, or reference counting with correct acquire/release ordering. When that synchronization is faulty, a thread can observe or manipulate an object in an inconsistent state, producing a classic race (often a time-of-check-to-time-of-use window) that can be turned into memory corruption, an object lifetime bug, or a broken security check. The CVSS vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H is consistent with that model: the attacker must already be running code on the box under a low-privileged token, competes for a narrow timing window in the kernel, and upon success gains broad control over the host without crossing a scope boundary into other security authorities. Microsoft's reporting tags associate the issue with both a race condition and information disclosure, though the assessed impact is full privilege escalation, indicating the race can be steered toward either reading kernel memory or subverting a privileged operation.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated user (AV:L/PR:L), race condition makes success timing-dependent (AC:H), and kernel compromise yields full SYSTEM impact (C:H/I:H/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A high-severity local privilege escalation vulnerability in the Windows Kernel allows an attacker with existing low-privileged access to a Windows host to elevate to SYSTEM privileges, potentially leading to full system compromise. While no public exploit identified at time of analysis, successful exploitation could enable attackers to steal data, deploy ransomware, or disrupt critical operations. Organizations should prioritize mitigating this risk for any Windows systems, especially those where users or attackers may already have a foothold.
Enforce least privilege, monitor for anomalous privilege escalation, apply application whitelisting, restrict local admin rights, and enable advanced auditing for privilege escalation events.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Exploit-DB