EUVD-2026-43826
GHSA-44rq-rg9q-573c
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with an existing low-privileged account is required (AV:L/PR:L); the race-condition timing window makes exploitation unreliable (AC:H); successful EoP yields full local compromise (C:H/I:H/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows AppX Deployment Service (AppXSvc) lets an already-authenticated, low-privileged user win a race condition to elevate to higher privileges across a broad range of Windows client and server builds (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025). The flaw stems from improper synchronization of a shared resource, and successful exploitation yields full confidentiality, integrity, and availability impact on the host. It is reported by Microsoft with a vendor patch available; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The AppX Deployment Service (AppXSvc) is the Windows component responsible for installing, updating, and removing packaged (MSIX/AppX) applications, and it runs with elevated system privileges to perform those deployment operations. The root cause is CWE-362 (concurrent execution using a shared resource with improper synchronization, i.e. a race condition): two or more execution flows access a shared object without adequate locking, creating a narrow timing window in which a low-privileged attacker can interfere with a privileged operation. The affected CPE set spans the Windows 10/11 servicing branches and Windows Server 2012 through 2025 (including Server Core installations), indicating the vulnerable code path is part of the long-lived, shared AppX deployment stack rather than a single-edition feature.
RemediationAI
Apply the Microsoft security update for CVE-2026-49803, delivered through the monthly cumulative update for each affected build (Patch available per vendor advisory); the specific KB and fixed build number should be taken directly from the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49803, since an exact fix version is not included in the provided data. Because the CVSS vector requires local low-privileged access, effective compensating controls until patching include restricting interactive and low-privileged logon on sensitive/multi-user hosts, limiting which accounts can trigger AppX/MSIX package deployments, and monitoring AppXSvc activity and privilege-escalation telemetry; note that restricting packaged-app deployment can break legitimate MSIX install/update workflows, and hardening interactive logon may disrupt shared terminal-server usage. There is no network-facing exposure to block, so firewall changes do not apply.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-362 – Race Condition
View allSame technique Race Condition
View allShare
External POC / Exploit Code
Leaving vuln.today