EUVD-2026-43896
GHSA-j6fw-387g-rw6j
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local authenticated user (AV:L/PR:L) must win a non-deterministic race (AC:H) with no user interaction, yielding full C/I/A impact from the resulting privilege elevation.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Runtime (WinRT) affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a race condition (CWE-362) in the handling of a shared resource allows an already-authenticated low-privileged attacker to win a timing window and elevate to higher privileges. Exploitation requires winning a non-deterministic race (AC:H) and low-level access to the target host (PR:L, AV:L), and there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Microsoft has published an advisory and released a patch.
Technical ContextAI
The Windows Runtime (WinRT) is the core component/object model that underpins modern (UWP/AppX) and many in-box Windows applications and services, providing a language-projected API surface layered over Windows. The flaw is a CWE-362 concurrent-execution-using-shared-resource-with-improper-synchronization (race condition): two or more threads access a shared object/resource without adequate locking, creating a time-of-check-to-time-of-use style window. By repeatedly triggering the code path and timing an operation to land inside that window, an attacker can manipulate the shared resource in a way the developer did not anticipate, corrupting state or substituting a resource that is then acted upon with the privileges of the WinRT-hosting process. The CPE data ties this specifically to Microsoft Windows 11 versions 24H2, 25H2 and 26H1, and Windows Server 2025 including the Server Core installation.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-50322 via Windows Update / WSUS / your normal Patch Tuesday process to all Windows 11 24H2, 25H2, 26H1 and Windows Server 2025 (including Server Core) systems; the exact fixed build is listed at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50322 (no specific fix build number was provided in this dataset, so pull it from the advisory rather than assuming). No vendor workaround was published; because exploitation requires local authenticated access, the primary compensating control until patching is to restrict interactive and local logon rights to trusted accounts and reduce the number of low-privileged users on high-value hosts (domain controllers, RDS/multi-user servers, jump boxes), accepting the trade-off that this limits legitimate multi-user access. Monitoring for repeated crashes or anomalous behavior in WinRT-hosting processes can help detect the many-attempt nature of race-condition exploitation, though this is detective rather than preventive.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today