Windows UI Automation CVE-2026-45597

Exploitation requires the attacker to already hold a valid low-privileged authenticated session on the target Windows machine (PR:L) and to execute code locally (AV:L) - remote network exploitation is not in scope. The flaw is in uiamanager.dll, so the attacker must be able to invoke or trigger UI Automation Manager code paths and reliably win a timing-sensitive race against another thread accessing the shared resource, which the High attack complexity (AC:H) flag indicates is non-trivial and may require many attempts or specific scheduling conditions. No user interaction is required (UI:N), and the scope is unchanged (S:U), meaning the elevation occurs within the same security authority rather than crossing into another sandbox. Limiting factors are therefore: prior local foothold, the timing reliability of the race, and presence of the affected uiamanager.dll build.

The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) paints a nuanced picture: high impact across the CIA triad but tempered by local-only attack vector, high attack complexity, and required low-privilege authentication. The High attack complexity is consistent with race conditions, which typically require precise timing and may need multiple attempts to win the race. There is no CISA KEV listing, no EPSS score provided, and no public exploit identified at time of analysis, so this is not a 'patch immediately for active threat' situation but rather a meaningful local EoP that matters most on multi-user systems, shared workstations, and machines where a low-privileged foothold might already exist. The combination of high impact with high complexity suggests targeted post-compromise abuse rather than widespread opportunistic exploitation.

An attacker who has already obtained low-privileged code execution on a Windows host - for example via phishing, a malicious document, or an existing standard user account - runs a tool that repeatedly invokes UI Automation Manager operations while a second thread races to manipulate the shared resource during the unsynchronized window. After winning the race (likely requiring many attempts due to AC:H), the process gains elevated privileges sufficient to read protected data, alter system state, or install persistence. No public proof-of-concept is identified at this time, but race-condition EoPs in core Windows DLLs have historically been weaponized once details emerge.