Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable with no auth or interaction (AV:N/PR:N/UI:N), but winning the race is non-deterministic so AC:H; successful EoP yields total impact (C:H/I:H/A:H), scope unchanged.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an unauthorized attacker to elevate privileges over a network.
AnalysisAI
Elevation of privilege in the Windows Runtime (WinRT) component of Microsoft Windows and Windows Server allows an unauthorized network attacker to win a race condition and gain elevated privileges, achieving full compromise of confidentiality, integrity, and availability. The flaw affects a broad range of supported builds - Windows 10 (1809/21H2/22H2), Windows 11 (24H2/25H2/26H1), and Windows Server 2019/2022/2025 - and Microsoft has shipped patches. There is no public exploit identified at time of analysis and CISA/SSVC records no known exploitation, though the low CVSS attack complexity of winning the race is offset by the high technical impact.
Technical ContextAI
The vulnerability is classified as CWE-362 (concurrent execution using a shared resource with improper synchronization, i.e. a race condition) in the Windows Runtime (WinRT), the object-based application-programming layer that underpins modern Windows APIs and is present across all supported client and server SKUs. Because WinRT brokers requests among components with differing privilege levels, a Time-of-Check-to-Time-of-Use style window in its handling of a shared resource can let an attacker manipulate state between validation and use. The CPE set (cpe:2.3:a:microsoft:windows_10_version_1809 through windows_server_2025, including Server Core installations) confirms this is a core-OS defect rather than an optional feature, meaning virtually every default installation ships the affected code path.
RemediationAI
Apply Microsoft's security updates via the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50452 (Vendor-released patch: install builds at or above the fixed versions - Windows 10 1809/Server 2019 10.0.17763.9020, Windows 10 21H2 10.0.19044.7548, Windows 10 22H2 10.0.19045.7548, Windows 11 24H2 10.0.26100.8875, Windows 11 25H2 10.0.26200.8875, Windows 11 26H1 10.0.28000.2269, Windows Server 2022 10.0.20348.5386, and Windows Server 2025 10.0.26100.33158). Prioritize patching internet-facing and high-value systems first because the vector is network-reachable. No vendor workaround is published; as compensating controls until patching, restrict network reachability to WinRT/RPC-based management surfaces by firewalling SMB/RPC (TCP 135/445) and dynamic RPC ports at network boundaries and enforcing host-based segmentation, accepting that this can break legitimate remote-management and inter-service traffic - validate in a staging environment before broad rollout. Also see the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-50452.
More in Windows 10 Version 1809
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Same weakness CWE-362 – Race Condition
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today
EUVD-2026-43893
GHSA-p5cq-9q4c-rvv7