Windows App Store CVE-2026-50356

Requires the attacker to already have a local, authenticated foothold with low privileges (PR:L) on the target Windows system and the ability to run code there - remote or unauthenticated exploitation is not possible (AV:L, UI:N). Exploitation further depends on winning a timing-sensitive race condition in the Windows App Store/AppX deployment path (AC:H), meaning success is probabilistic and may require many attempts, and the target must have the AppX/Store servicing component active (default on supported Windows editions). These factors - local access, pre-existing valid credentials, and the difficulty of reliably winning the race - substantially limit realistic exploitation despite the High CVSS score.

The signals are consistent and point to a genuine but not top-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 High) shows local-only access, existing low privileges, and high complexity, yet full confidentiality/integrity/availability impact once won. No EPSS score was provided, it is not in CISA KEV, and no POC is referenced, so this is neither confirmed actively exploited nor known to have public exploit code. The AC:H rating (winning a timing race reliably is non-trivial) meaningfully lowers real-world exploitability compared to a straightforward EoP. One conflict worth flagging: the CVE description states privilege elevation, but the intelligence Tags label this 'Information Disclosure' - the CVSS scope is Unchanged with high impact across C/I/A, so treat it primarily as a local EoP and verify the exact impact against the MSRC advisory. Overall: patch on a normal cadence for a local EoP; not an emergency absent active exploitation.

A low-privileged but authenticated user on a shared Windows host (for example a terminal/RDS server or a workstation with standard user accounts) runs a purpose-built process that repeatedly triggers an AppX/Store deployment operation while racing to swap a shared resource in the validation-to-use window. On a successful race, their code executes with elevated privileges, giving full control of the machine. Reliability is limited by the high attack complexity, and no public POC is referenced at this time.