EUVD-2026-43894
GHSA-q4pv-ph9w-px5v
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated (AV:N/PR:N/UI:N), but timing-dependent race lowers reliability (AC:H); authorization bypass yields total compromise (C/I/A:H), unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an unauthorized attacker to elevate privileges over a network.
AnalysisAI
Privilege elevation in the Windows Runtime (WinRT) component of Windows 10, Windows 11, and Windows Server 2019-2025 allows a remote, unauthenticated attacker to win a race condition and gain elevated privileges over the network. Reported by Microsoft with a vendor patch available; there is no public exploit identified at time of analysis, EPSS is low (0.33%, 25th percentile) and CISA SSVC records exploitation status as none, though technical impact is rated total.
Technical ContextAI
The flaw resides in the Windows Runtime (WinRT), the object-oriented API surface introduced with Windows 8 that underpins modern Windows app and system component interaction and is present across all supported Windows client and server SKUs. The root cause is CWE-362, concurrent execution using a shared resource with improper synchronization - a classic race condition (TOCTOU-style window) where two threads or processes access shared state without adequate locking, letting an attacker manipulate the resource between a check and its use to subvert an authorization or state decision. The 'Authentication Bypass' tag suggests the winning of the race circumvents an access-control check, which aligns with the high confidentiality, integrity, and availability impact and the total technical impact rating.
RemediationAI
Apply the Microsoft security update for your specific Windows build as the primary and complete fix: update Windows 10 1809 / Server 2019 to 10.0.17763.9020 or later, Windows 10 21H2 to 10.0.19044.7548, Windows 10 22H2 to 10.0.19045.7548, Windows 11 24H2 to 10.0.26100.8875, Windows 11 25H2 to 10.0.26200.8875, Windows 11 26H1 to 10.0.28000.2269, Windows Server 2022 to 10.0.20348.5386, and Windows Server 2025 to 10.0.26100.33158, per the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50348. Because the vector is network-based, until patches are deployed reduce exposure by restricting network access to affected hosts through host and perimeter firewalls, limiting the RPC/WinRT-reachable surface to trusted management networks and segmenting servers - accepting that tightening network reachability of WinRT/RPC services can disrupt legitimate remote management and inter-service communication. No reliable non-patch workaround eliminates the race condition itself, so prioritize the update rather than relying on network controls alone.
More in Windows Server 2019
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-362 – Race Condition
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today