EUVD-2026-43791
GHSA-gr87-xh8q-83qf
Severity by source
AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Local EoP needing an authenticated user (PR:L) and a hard-to-win race (AC:H); privileged code execution yields full C/I/A and a changed scope (S:C).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Push Notifications component (WPN) affects Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2025 including Server Core, where a race condition (CWE-362) lets an authorized local user win a timing window on a shared resource to run code at a higher privilege level. Microsoft reported the issue and has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Note a signal conflict: the description and CVSS impact frame this as privilege elevation, while the vendor tags also list 'Information Disclosure' - the primary impact should be treated as EoP pending vendor clarification.
Technical ContextAI
The affected component is the Windows Push Notification Service infrastructure (WPN), the OS subsystem that brokers toast/tile notifications between apps and the system across user sessions. The root cause is CWE-362 (concurrent execution using a shared resource with improper synchronization, a 'race condition'): two or more threads or processes access shared state without adequate locking, allowing an attacker who controls timing to interleave operations and manipulate the resource in a privileged context. The CPE data scopes this to Microsoft Windows 11 versions 23H2, 24H2, 25H2 and 26H1, plus Windows Server 2025 and its Server Core installation, indicating a defect in modern Windows servicing branches rather than legacy code.
RemediationAI
Apply the Microsoft security update for the affected SKU as the primary fix - a vendor patch is available per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44800; deploy the corresponding monthly cumulative update for Windows 11 (23H2/24H2/25H2/26H1) or Windows Server 2025 (including Server Core) via Windows Update, WSUS, or your patch-management pipeline, and reboot to complete servicing. Exact fixed build numbers should be taken from the MSRC page rather than guessed. Because exploitation requires an authenticated local account, compensating controls until patching completes include tightening local access - restrict interactive and remote-interactive logon rights to trusted administrators, enforce least privilege so standard users cannot introduce untrusted binaries, and apply application allowlisting (e.g. WDAC/AppLocker) to block attacker tooling that would drive the race; the trade-off is added administrative overhead and potential friction for legitimate low-privilege workflows. There is no documented feature toggle that disables Windows Push Notifications as a standalone mitigation without affecting notification functionality, so patching is the reliable remedy.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today