Windows Runtime CVE-2026-50345

Exploitation requires the attacker to already have authenticated local access with low privileges (PR:L) and the ability to execute code on the target Windows 11 24H2/25H2/26H1 or Windows Server 2025 host; it cannot be triggered remotely or by an unauthenticated user (AV:L, UI:N). Realistic risk is limited by the high attack complexity (AC:H): success depends on winning a non-deterministic timing race in a shared WinRT resource, so exploitation is probabilistic and may require repeated attempts rather than being reliable on the first try. No special product feature or non-default configuration is called out in the description - the affected code path appears present in default installations of the listed versions.

The CVSS 3.1 base score is 7.0 (High) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - exploitation requires local access and existing low-level privileges, and the AC:H metric reflects that winning the race is timing-dependent and not reliably reproducible on demand. Against that, the impact triad is fully High, so a successful win grants meaningful control over the host. No EPSS score, POC, or KEV signal was provided, and it is not in CISA KEV, so there is no evidence of active or imminent widespread exploitation; the realistic profile is a post-compromise escalation primitive an attacker chains after already having a foothold, not an internet-facing mass-exploitation risk. The AC:H and PR:L conditions materially lower practical exploitability compared with the raw High score. Note the source Tags list 'Information Disclosure' while the CVSS/description describe privilege elevation with full CIA impact - this discrepancy should be verified against Microsoft's advisory.

An attacker who already holds a low-privileged local account or has landed low-integrity code (e.g., via phishing or an initial-access exploit) runs a tool that repeatedly triggers the vulnerable WinRT code path while racing a second thread to manipulate the shared resource during the timing window. On a successful race they corrupt privileged state and elevate to higher privileges on the host. No public POC is identified, and the AC:H rating means the attacker may need many attempts to hit the window reliably.