Microsoft EUVD-2026-22406

This vulnerability stems from a race condition (CWE-362) in the Windows Push Notifications (WPN) service, a core Windows component responsible for handling toast notifications, live tiles, and push notification delivery to applications. Race conditions occur when multiple threads or processes access shared resources without proper synchronization primitives (mutexes, semaphores, critical sections). The CVSS vector indicates local access (AV:L) with changed scope (S:C), suggesting the vulnerability allows escaping the security context of the WPN service to impact resources beyond its privilege boundary. The WPN service typically runs with elevated privileges to interact with user sessions and system resources, making it an attractive target for privilege escalation. The high attack complexity (AC:H) suggests exploitation requires precise timing or specific system conditions, characteristic of time-of-check-time-of-use (TOCTOU) vulnerabilities or similar synchronization flaws. Affected products span Windows 10 builds 19044/19045, Windows 11 builds 22631/26100/26200/28000, and Windows Server 2022/2025 (builds 20348/25398/26100), indicating the vulnerable code exists across multiple Windows NT kernel branches.