Windows Runtime CVE-2026-50460

Exploitation requires network access to the affected Windows Runtime code path on an unpatched host (AV:N) and, critically, the attacker must reliably win a race condition - repeatedly triggering concurrent access to the shared resource to hit the narrow unsynchronized timing window (reflected in AC:H). No prior authentication or privileges are needed (PR:N) and no user interaction is required (UI:N), so exploitation does not depend on a victim's action or credentials. Exploitation is limited chiefly by the timing/reliability of winning the race, which typically demands many concurrent attempts and stable low-latency access to the target, and by the host being an affected, unpatched Windows 10/11 or Windows Server 2019/2022/2025 build; exact triggering preconditions should be confirmed against the MSRC advisory.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H yields 8.1 (High): network reachable (AV:N), no privileges (PR:N) and no user interaction (UI:N) required, but high attack complexity (AC:H) because the attacker must reliably win a race condition - a timing-dependent condition that resists opportunistic mass exploitation. Impact is severe (C:H/I:H/A:H) and the 'Authentication Bypass' tag reinforces that a successful race can defeat authorization. No EPSS score or SSVC decision data was provided, and there is no public exploit identified and no CISA KEV listing, so real-world exploitation pressure appears low today despite the high base score. Practical priority is nonetheless elevated by the enormous install base; treat it as a standard patch-cycle item to accelerate on internet-facing or high-value Windows hosts. One tension to verify: the description frames this as privilege elevation 'over a network' while EoP is conventionally local - Microsoft's mapping of a network vector to a privilege-escalation outcome (via the authentication-bypass behavior) should be confirmed against the MSRC advisory for exact preconditions.

A remote attacker with network reachability to an unpatched Windows host repeatedly and concurrently invokes the affected Windows Runtime code path, racing to hit the narrow unsynchronized window between an authorization check and the protected operation. On a successful race the attacker bypasses the authentication/privilege check and executes with elevated privileges, gaining full control over the target. No public exploit code is identified at time of analysis, and the high attack complexity means an attacker likely needs many attempts to win the race.