EUVD-2026-43973
GHSA-cw94-x264-qp4r
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated foothold required (AV:L/PR:L), race condition makes reliable exploitation hard (AC:H), and successful elevation yields full system compromise (C:H/I:H/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Installer allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows App Installer (App Installer / MSIX handler) on Windows 11 (23H2 through 26H1) and Windows Server 2025 lets an already-authenticated local attacker win a timing race to elevate to higher privileges. The flaw stems from improper synchronization of a shared resource during concurrent execution, and Microsoft has released a patch. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
Windows App Installer is the built-in Microsoft component (App Installer / AppInstaller.exe, associated with MSIX/.appx package installation and the ms-appinstaller protocol) shipped with modern Windows client and server editions. The root cause is CWE-362, a race condition arising from concurrent execution using a shared resource with improper synchronization (a TOCTOU-style window). During package handling, an attacker who can run code locally races the installer's operation on a shared object or file so that a check and the subsequent privileged use of that resource are not atomic, allowing the attacker to substitute or manipulate the resource in the timing gap and have privileged code act on attacker-controlled data. The CPE set confirms the affected code ships across Windows 11 versions 23H2, 24H2, 25H2, 26H1, and Windows Server 2025 including Server Core.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update for CVE-2026-48572 referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48572, which updates the App Installer component across affected Windows 11 and Windows Server 2025 builds; because App Installer can update out-of-band through the Microsoft Store, ensure the Store/App Installer package itself is current in addition to applying monthly OS updates. The provided data does not specify an exact fixed version, so confirm the target build from the MSRC page before deploying. As a compensating control on high-risk multi-user systems, restrict local interactive logon so untrusted low-privileged users cannot run code locally (this is required to even attempt the race), and consider restricting or disabling the ms-appinstaller protocol handler and non-admin app sideloading via policy where operationally acceptable - the trade-off is that legitimate self-service MSIX installs for standard users will be blocked. Prioritize patching terminal servers, shared workstations, and Server 2025 hosts where multiple users share the machine.
More in Windows 11 Version 23H2
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Remote code execution in the Microsoft Windows FTP Service allows an unauthenticated network attacker to run arbitrary c
Remote code execution in Microsoft Windows DNS lets an unauthenticated attacker corrupt heap memory over the network and
Local privilege escalation in Microsoft Windows Hyper-V (Windows 11 22H3/23H2 and Windows Server 2022) stems from a use-
Remote code execution in the Microsoft ODBC Driver for SQL Server (shipped across Windows 10, Windows 11, and Windows Se
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver lets an authenticated low-privileged u
Windows Shell security feature bypass enables unauthenticated remote attackers to defeat protection mechanisms across al
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an already-authenticate
Local privilege escalation in Windows Kernel across Windows 10, Windows 11 (versions 22H3 through 26H1), and Windows Ser
Local privilege escalation in the Windows Remote Desktop component (CWE-122 heap-based buffer overflow) allows an authen
Local privilege escalation in the Win32K GRFX (graphics) subsystem of Microsoft Windows allows an authenticated, low-pri
Same weakness CWE-362 – Race Condition
View allSame technique Race Condition
View allShare
External POC / Exploit Code
Leaving vuln.today