Windows Embedded Mode CVE-2026-96932

Requires the attacker to already hold local, authenticated low-privilege access to the Windows host (PR:L, AV:L) - this is not remotely reachable. Exploitation further depends on winning a race condition (CWE-362) against the Embedded Mode Service: the attacker must reliably hit a narrow timing window during concurrent access to a shared resource, which the CVSS AC:H rating marks as a significant limiting factor reducing exploit reliability. No user interaction by a victim is needed (UI:N). The affected service ships across Windows 10 (1607-22H2), Windows 11 (23H2-26H2), and Windows Server 2016-2025; apply the fixed build for each edition listed in EUVD-2026-100256 (e.g. Server 2022 >=10.0.20348.5761, Windows 11 24H2 >=10.0.26100.9711).

This is a locally-exploitable elevation-of-privilege flaw (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U with C:H/I:H/A:H) arising from a race condition (CWE-362) in the Windows Embedded Mode Service. The CVSS vector is internally consistent with the description's 'authorized attacker ... elevate privileges locally': AV:L and PR:L confirm the attacker must already have local, authenticated (low-privilege) access, and AC:H reflects the timing-dependent nature of winning the race window, which materially lowers reliability of exploitation. No EPSS score, CISA KEV entry, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the practical priority is moderate rather than urgent. Note a signal conflict in the metadata: the vulnerability is tagged 'Information Disclosure', yet both the description and the full C:H/I:H/A:H impact describe privilege elevation (full system compromise), not mere disclosure; treat the impact as EoP and verify the tag with the vendor. Overall this is a credible local EoP worth patching in the normal Patch-Tuesday cycle, but the high attack complexity and lack of any exploitation evidence argue against emergency out-of-band response.

A low-privileged but authenticated user already present on a Windows host runs a program that repeatedly manipulates a resource shared with the Embedded Mode Service, racing to win a narrow timing window during a state transition. On a successful race, the attacker corrupts the service's handling of the shared resource to execute code at the service's elevated privilege level, gaining SYSTEM-level control. No public exploit code was identified at time of analysis, and the AC:H rating means exploitation is non-deterministic and may require many attempts.