Microsoft EUVD-2026-22549

This vulnerability exploits a classic race condition (CWE-362) in Windows Push Notifications Platform User Service (WpnUserService), a component responsible for managing notification delivery and display across Windows desktop and server environments. Race conditions occur when multiple threads or processes access shared resources without proper synchronization primitives (mutexes, semaphores, critical sections). The Windows notification subsystem handles inter-process communication between applications requesting notifications and system-level services rendering them, creating windows of opportunity where Time-Of-Check-Time-Of-Use (TOCTOU) attacks can occur. An attacker with low-privilege local access can manipulate the timing of concurrent notification requests to corrupt shared memory structures, bypass security checks, or hijack privileged operations performed by the SYSTEM-context notification service. The scope change (S:C) in CVSS indicates the vulnerability allows escaping the security boundary of the WpnUserService process to impact other Windows subsystems. The affected CPE strings confirm impact across the entire modern Windows ecosystem from legacy 1809 builds through current 26H1 preview releases, including Server Core installations lacking GUI components but still running notification infrastructure for administrative alerts.