EUVD-2026-43973
GHSA-cw94-x264-qp4r
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated foothold required (AV:L/PR:L), race condition makes reliable exploitation hard (AC:H), and successful elevation yields full system compromise (C:H/I:H/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Installer allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows App Installer (App Installer / MSIX handler) on Windows 11 (23H2 through 26H1) and Windows Server 2025 lets an already-authenticated local attacker win a timing race to elevate to higher privileges. The flaw stems from improper synchronization of a shared resource during concurrent execution, and Microsoft has released a patch. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must have valid low-privileged local access to the machine (PR:L, AV:L - no remote or network exploitation, no user interaction). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 High) tells a nuanced story: the attacker must already have local access with low privileges (PR:L), and exploitation is genuinely hard (AC:H) because it depends on winning a non-deterministic timing race - but if won, impact is full confidentiality, integrity, and availability compromise (C:H/I:H/A:H) via privilege elevation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged user on a shared Windows 11 or Windows Server 2025 host runs a small tool that repeatedly triggers an App Installer operation while concurrently swapping a shared file or object during the narrow check-to-use window. After many attempts it wins the race, causing the privileged installer path to act on attacker-controlled content and execute code at elevated privilege. … |
| Remediation | Patch available per vendor advisory - apply the Microsoft security update for CVE-2026-48572 referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48572, which updates the App Installer component across affected Windows 11 and Windows Server 2025 builds; because App Installer can update out-of-band through the Microsoft Store, ensure the Store/App Installer package itself is current in addition to applying monthly OS updates. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify and catalog all Windows 11 (versions 23H2-26H1) and Windows Server 2025 systems in your environment, and assess their criticality and user populations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Windows 11 Version 23H2
View allRemote code execution in the Microsoft Windows FTP Service allows an unauthenticated network attacker to run arbitrary c
Remote code execution in the Microsoft ODBC Driver for SQL Server (shipped across Windows 10, Windows 11, and Windows Se
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver lets an authenticated low-privileged u
Local privilege escalation in Windows Kernel across Windows 10, Windows 11 (versions 22H3 through 26H1), and Windows Ser
Local code execution in Microsoft Windows NTFS (the New Technology File System driver) arises from a heap-based buffer o
Local privilege escalation in the Windows Push Notifications component (WPN) affects Windows 11 (23H2, 24H2, 25H2, 26H1)
Local privilege escalation in Windows Secure Kernel Mode (SKM/VTL1) allows an already-authenticated attacker to elevate
Denial of service in the Windows Local Security Authority Subsystem Service (LSASS) allows a remote, unauthenticated att
Local code execution in Microsoft Windows NTFS driver allows an authenticated attacker to run arbitrary code by triggeri
Local privilege escalation in the Windows DirectX graphics subsystem allows an authenticated attacker with low privilege
Local privilege elevation in the Windows WebView component affects a broad range of currently-supported Windows client a
Local privilege escalation in Microsoft Windows App Installer (the AppX/MSIX deployment component) lets a low-privileged
Same weakness CWE-362 – Race Condition
View allSame technique Race Condition
View allShare
External POC / Exploit Code
Leaving vuln.today