EUVD-2026-44309
GHSA-qxc6-2c9c-7vxv
Severity by source
AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Local authenticated foothold gives PR:L and AV:L; the race condition forces AC:H; escalation crosses to SYSTEM giving S:C with full C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Wireless Networking allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Wireless Networking component affects a broad span of currently supported Windows releases (Windows 10 1809 through Windows 11 26H1, and Windows Server 2019/2022/2025), letting an already-authenticated local user win a timing race to gain SYSTEM-level control. The flaw is a CWE-362 race condition where improperly synchronized access to a shared resource can be manipulated during a narrow execution window; CVSS 7.8 reflects a high-complexity but high-impact local escalation with a scope change. Microsoft (the reporter) has shipped a patch, and there is no public exploit identified at time of analysis.
Technical ContextAI
The vulnerability lives in the Windows Wireless Networking subsystem, the OS-level stack that manages Wi-Fi adapters, connection state, and associated privileged services. The root cause is CWE-362 (concurrent execution using a shared resource with improper synchronization, i.e. a race condition): two or more execution paths access a shared object without adequate locking, so an attacker who can interleave operations at the right moment can force the code into an unintended, higher-privileged state. The CPE data confirms this is the core Windows OS across both client (Windows 10 1809/21H2/22H2, Windows 11 24H2/25H2/26H1) and server (Windows Server 2019, 2022, 2025, including Server Core) SKUs, indicating shared platform code rather than a single edition. The CVSS scope-change flag (S:C) signals that successful exploitation crosses a security boundary, consistent with a low-privileged process influencing a SYSTEM-context service.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security update for CVE-2026-58628 via the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58628, which lists the fixed build for each affected Windows edition (exact fixed version numbers were not included in this input and should be taken from that advisory rather than assumed). Because this is a local privilege-escalation race condition requiring an authenticated foothold, prioritize patching on multi-user and shared systems (RDP hosts, jump boxes, terminal servers) where untrusted low-privileged accounts exist. As interim compensating controls until patching, restrict interactive and remote-login access to trusted administrators only and remove unnecessary local accounts to shrink the pool of potential attackers, and monitor for repeated crashes or anomalous behavior in wireless networking services which can indicate failed race-exploitation attempts; note these controls reduce opportunity but do not eliminate the flaw, and on servers that do not use Wi-Fi the practical exposure is lower though the vulnerable code may still be present.
More in Windows Server 2019
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today