Windows Media CVE-2026-50404

The attacker must already have local, authenticated access with low privileges (CVSS PR:L, AV:L) on an affected Windows 11 build (24H2, 25H2, or 26H1) - this is not remotely exploitable and requires an existing foothold. Exploitation depends on winning a race condition in the Windows Media component (CWE-362): the attacker must run concurrent code that hits the unsynchronized shared resource during a narrow timing window, which the AC:H rating reflects as difficult and unreliable, potentially needing repeated attempts and specific system-load conditions. No user interaction is required (UI:N). The primary limiting factors are the mandatory prior local access and the high timing precision required, which together make opportunistic mass exploitation impractical.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H yields a base score of 7.0 (High): local vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and full C/I/A impact. The key limiting signal is AC:H - race conditions are inherently unreliable to trigger, so successful exploitation may require many attempts and favorable system load. It is a local elevation-of-privilege issue, so it is not remotely reachable and requires an attacker to already have a foothold with low-level authenticated access. No EPSS score was provided in the input; no POC is referenced; and the CVE is not in CISA KEV, so there is no evidence of active exploitation. Net assessment: a genuine post-compromise escalation risk worth patching in normal cycles, but not an emergency - the high complexity and local-only vector place it below internet-facing or wormable threats. Note a minor inconsistency: the Tags list 'Information Disclosure' while the description and CVSS (C:H/I:H/A:H) frame this as privilege elevation - verify the precise impact with Microsoft's advisory.

An attacker who has already obtained a low-privileged authenticated session on a Windows 11 host (for example, via phishing or a limited-access account) runs a local program that repeatedly triggers the Windows Media component while racing a second thread to manipulate the shared resource during the window between check and use. On a successful race, the attacker's code executes with elevated privileges, enabling full compromise of the machine. No public exploit is identified at time of analysis, and the high attack complexity means exploitation likely requires many attempts to win the timing window.