EUVD-2026-43919
GHSA-w3hg-m9hj-8hr8
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable with no auth or interaction (AV:N/PR:N/UI:N) but AC:H because a race window must be won; authentication bypass yields full C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an unauthorized attacker to elevate privileges over a network.
AnalysisAI
Elevation of privilege in Microsoft Windows Runtime (WinRT) lets a remote, unauthenticated attacker win a timing window in a shared-resource race condition and gain higher privileges across a broad range of Windows client and server releases (Windows 10 1809 through Windows 11 26H1 and Windows Server 2019/2022/2025). Microsoft-reported and patched, the flaw carries CVSS 8.1, driven by full confidentiality, integrity, and availability impact but tempered by high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Windows Runtime (WinRT) is the object/component model and API surface underlying modern Windows apps and many OS services, shared across client and server SKUs. The root cause is CWE-362, concurrent execution using a shared resource with improper synchronization (a race condition): two or more threads or requests access the same resource without adequate locking, creating a narrow window in which state can be manipulated between check and use. Per the input tags this race is leveraged as an authentication bypass, allowing an attacker who reaches the affected code path over the network to subvert a privilege or authorization decision. The affected CPE set spans Windows 10 Version 1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2019, 2022, and 2025 (including Server Core), indicating the vulnerable component ships in the base OS rather than an optional feature.
RemediationAI
Apply the Microsoft security update for CVE-2026-50460 via Windows Update or WSUS/SCCM; a vendor patch is available and Microsoft publishes the exact fixed build per affected SKU in its advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50460 - apply the KB matching each Windows 10/11 or Windows Server 2019/2022/2025 release, including Server Core hosts. Because exact per-build fix versions are enumerated only in the MSRC update guide, consult that page to confirm the patched build for your environment rather than relying on a single version string. Until patching completes, reduce network exposure of affected hosts by restricting inbound access to the Windows Runtime-backed service through host and perimeter firewalls and network segmentation so only trusted management networks can reach it; the trade-off is potential disruption to legitimate remote clients or management tooling that depend on that service, so validate connectivity requirements before applying blocks. Prioritize internet-facing servers and domain controllers.
More in Windows 10 Version 1809
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Same weakness CWE-362 – Race Condition
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today