Windows Server 2019 CVE-2026-32163

Attacker requires low-privilege local user account on affected Windows systems. Exploitation involves race condition in Windows User Interface Core requiring specific timing conditions (AC:H indicates high complexity). No victim interaction needed. Affects Windows installations with vulnerable UI Core versions.

Real-world risk is substantial despite high attack complexity (AC:H). The CVSS score of 7.8 reflects severe potential impact (C:H/I:H/A:H) with scope change, meaning successful exploitation grants elevated privileges across security boundaries. Attack prerequisites require local access with low-privilege credentials (AV:L/PR:L), limiting exposure compared to network-based vulnerabilities but remaining exploitable in common enterprise scenarios: shared workstations, terminal servers, compromised user accounts, or insider threats. High attack complexity suggests exploitation requires winning a race condition, demanding precise timing or repeated attempts, which reduces reliability but does not eliminate risk. No public exploit identified at time of analysis and no CISA KEV listing indicate this is not yet actively exploited in the wild. However, the wide deployment footprint (all supported Windows versions), combined with vendor patch availability, elevates this to priority remediation status for environments where local privilege escalation represents material risk, particularly multi-tenant systems, domain-joined workstations, and server infrastructure where lateral movement follows initial compromise.

An attacker with low-privilege domain user credentials gains access to a shared Windows 10 workstation or Windows Server 2022 terminal server. The attacker executes a custom exploit targeting Windows UI Core, repeatedly triggering concurrent UI operations to create race conditions in shared resource access. By winning the timing window through repeated attempts, the attacker manipulates kernel object states during UI processing, causing the system to grant elevated privileges outside the original security context. With SYSTEM-level access achieved, the attacker disables security monitoring, installs persistence mechanisms, and pivots to other domain resources.