Windows App Store CVE-2026-49784

The attacker must already have local, authenticated access with at least low privileges on the target (AV:L/PR:L) - this is not remotely reachable and requires no user interaction from a victim (UI:N). The core prerequisite is the ability to run concurrent operations that touch the App Store component's improperly synchronized shared resource and to win the race, so exploitation depends on repeatedly triggering the packaging/servicing code path while manipulating that resource. The chief limiting factor is the timing window itself: AC:H indicates the race is hard to win reliably, likely requiring many scripted attempts and specific system conditions (load, scheduling), which makes single-shot exploitation unlikely. Highest realistic exposure is on multi-user hosts (Terminal/RDS servers, shared workstations) where untrusted low-privileged accounts have local execution.

The CVSS 3.1 base score is 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. This is a genuine but not top-tier priority: the local attack vector (AV:L) and required low privileges (PR:L) mean the attacker must already have authenticated code execution on the host, and the high attack complexity (AC:H) reflects the inherent unreliability of winning a race condition. Offsetting that, the impact is full high on confidentiality, integrity, and availability, consistent with a privilege escalation to a higher-integrity context. No EPSS score, KEV listing, SSVC decision, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Note a minor inconsistency in source tagging: the CVE description and CVSS describe privilege elevation, while the Tags include 'Information Disclosure' - treat the elevation-of-privilege framing (backed by the description and C/I/A:H) as authoritative and verify the disclosure angle with Microsoft. Overall this is a standard Patch-Tuesday-class local EoP: patch on normal cadence, prioritizing multi-user and shared hosts where untrusted low-privileged users have local access.

A low-privileged but authenticated user (or malware already running in a low-integrity context) on a shared workstation or Remote Desktop server repeatedly triggers the vulnerable Windows App Store operation while concurrently manipulating the shared resource, racing to hit the narrow timing window. On a successful interleaving the privileged component acts on attacker-controlled state, yielding code execution or resource access at higher privilege. Because AC:H reflects an unreliable race, the attacker likely scripts many attempts; no public POC is known at time of analysis.