EUVD-2026-43902
GHSA-m6x2-g79h-2cg4
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local-only race condition needs an existing low-priv session (AV:L/PR:L) and precise timing to win (AC:H); successful EoP yields full host C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Media allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege elevation in the Windows Media component of Windows 11 (versions 24H2, 25H2, and 26H1) allows an already-authenticated local attacker to win a race condition and gain higher privileges on the host. The flaw is a concurrency/synchronization defect (CWE-362) reported by Microsoft itself; no public exploit identified at time of analysis and it is not listed in CISA KEV. Exploitation is rated high-complexity because the attacker must reliably win a timing window, which tempers the otherwise high confidentiality, integrity, and availability impact.
Technical ContextAI
The vulnerability lives in Windows Media, the multimedia processing subsystem built into Windows 11. The root cause is CWE-362, a race condition arising from concurrent execution against a shared resource without proper synchronization (e.g., a time-of-check-to-time-of-use gap or a missing lock around shared state). When two threads or processes access the shared resource simultaneously, an attacker who controls timing can manipulate the state between validation and use, causing privileged code to operate on attacker-influenced data or objects. The CPE data confirms the affected surface is the OS-integrated component across three sequential Windows 11 builds (cpe:2.3:a:microsoft:windows_11_version_24h2, 25h2, and 26h1), indicating a defect carried forward across releases rather than a one-off regression.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50404 to the affected Windows 11 24H2, 25H2, and 26H1 systems; the exact patched build/KB is not enumerated in the input and should be pulled from the MSRC update guide, then deployed via Windows Update or WSUS/Intune. Because this is a local elevation-of-privilege flaw with no remote vector, prioritize systems where low-privileged or shared local access is common (multi-user hosts, RDS/VDI, kiosk, and developer machines). Pending patch deployment, compensating controls include limiting local logon and interactive access to trusted users to reduce the pool of attackers who already meet the PR:L prerequisite, and applying application allowlisting (e.g., WDAC/AppLocker) to block unauthorized local binaries that would be used to stage the race - with the trade-off that allowlisting requires tuning and can disrupt legitimate software. There is no known non-patch fix that removes the underlying synchronization defect, so the vendor update is the definitive remediation.
More in Windows 11 Version 24H2
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Local privilege escalation in the Microsoft Windows Kernel allows an already-authenticated attacker to elevate to SYSTEM
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today