EUVD-2026-44146
GHSA-5qf9-5c2h-vxx7
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local post-compromise EoP: AV:L and PR:L reflect an existing low-priv foothold, AC:L as the race is low-complexity to win, full C:H/I:H/A:H from SYSTEM-level escalation.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Windows Runtime (WinRT) across Windows 10, Windows 11, and Windows Server 2019 through 2025 allows an already-authenticated attacker to win a race condition and gain SYSTEM-level privileges. The flaw stems from concurrent access to a shared resource without proper synchronization, and full C:H/I:H/A:H impact indicates complete host compromise once triggered. Reported by Microsoft with a patch available; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Technical ContextAI
Windows Runtime (WinRT) is the object-oriented, cross-language API surface that underpins modern Windows apps and many core OS components across desktop and server SKUs. The root cause is CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization, a 'race condition'): two or more threads or processes access a shared resource without adequate locking, creating a time-of-check-to-time-of-use (TOCTOU) window an attacker can exploit to manipulate state after a security decision but before the resource is consumed. The CPE data confirms the affected surface is the OS runtime itself on Windows 10 (1809, 21H2, 22H2), Windows 11 (24H2, 25H2, 26H1), and Windows Server 2019/2022/2025 including Server Core installations, meaning this is a platform-level component present in essentially every Windows install rather than a discrete add-on product.
RemediationAI
Apply the Microsoft security update for CVE-2026-54125 as delivered through the monthly cumulative update for each affected Windows and Windows Server build (Patch available per vendor advisory); consult the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54125 to obtain the exact KB and patched build for your specific version, as the input does not enumerate a single fix version. Because exploitation requires an existing local, low-privileged foothold, effective compensating controls until patching completes include restricting and monitoring local/interactive logon rights, enforcing least privilege on service accounts, and applying application allow-listing (WDAC/AppLocker) to limit an attacker's ability to run the arbitrary local code needed to drive the race - the trade-off is administrative overhead and possible disruption to legitimate low-privilege tooling. Prioritize patching multi-user and RDP-accessible hosts (jump servers, terminal/session hosts) where untrusted low-privilege users are most likely present.
More in Windows 10 Version 1809
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Same weakness CWE-362 – Race Condition
View allSame technique Race Condition
View allShare
External POC / Exploit Code
Leaving vuln.today