EUVD-2026-43946
GHSA-9m59-v99v-j834
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 14, 2026
Local privilege escalation in the Windows Runtime affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where a race condition (CWE-362) in the improperly synchronized handling of a shared resource lets an already-authenticated attacker win a timing window to gain higher privileges. Microsoft reported and patched the issue; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The CVSS 8.8 with scope-changed impact reflects that a low-privileged local user could reach full SYSTEM-level control of confidentiality, integrity, and availability.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 5 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Know when Windows Server 2025 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privileges locally.
Executive ViewAI
A race condition in Windows Runtime enables local privilege escalation on Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, allowing authenticated users to gain full system control. This vulnerability threatens the confidentiality, integrity, and availability of affected systems, creating risk for unauthorized data access and lateral movement within your environment. Organizations running these Windows versions should treat this as a priority remediation target.
Within 24 hours: Inventory all Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 systems to determine exposure scope and identify systems requiring urgent patching. Within 7 days: Apply Microsoft's released patch to all identified affected systems, prioritizing systems with sensitive data access and elevated privilege boundaries. Within 30 days: Validate complete patch deployment across all assets, verify systems are fully remediated, and monitor event logs for any exploitation attempts prior to patching.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Exploit-DB