Windows Server 2019 CVE-2026-32158

Attacker must have local user privileges on Windows system. Requires precise timing to trigger concurrent execution in Windows Push Notifications service during shared resource access window. Default Windows Push Notification Service must be running.

Real-world risk is moderate despite the 7.8 CVSS score. The attack complexity is high (AC:H) requiring precise timing to win the race condition-attackers must repeatedly trigger concurrent operations until thread interleaving produces exploitable state. Low privilege requirement (PR:L) means any authenticated local user can attempt exploitation, but the Changed scope elevating to SYSTEM privileges makes this a high-value target for post-compromise persistence. SSVC assessment confirms exploitation status is 'none' (no active exploitation observed) and automatable is 'no' (timing precision prevents reliable automation), though technical impact is 'total' (full confidentiality/integrity/availability compromise). The local-only attack vector (AV:L) limits exposure compared to network-accessible vulnerabilities. No CISA KEV listing and no public POC reduce immediate threat, but the wide deployment footprint across enterprise Windows environments warrants prioritization for patching. Organizations already compromised with local attacker foothold face elevated risk as this provides reliable privilege escalation path.

An attacker with low-privileged local access to a corporate workstation running Windows 11 23H2 executes a custom tool that rapidly creates and destroys notification handlers while simultaneously triggering push notification events. By exploiting the race window between security token validation and notification dispatch, the attacker corrupts internal state causing the notification service to execute subsequent operations with SYSTEM privileges. The attacker then injects malicious code into the elevated context, achieving full administrative control over the system