Windows Push Notifications EUVD-2026-35739

Exploitation requires local interactive or authenticated session access to the target Windows host with at least low-privilege user rights (PR:L) and the ability to execute arbitrary code that interacts with the Windows Push Notifications service; no user interaction from another user is needed (UI:N). Limiting factors include high attack complexity (AC:H) - the attacker must reliably win a timing race window between concurrent threads accessing the shared resource, which typically demands many attempts and may be sensitive to CPU count, scheduler behavior, and system load - and the requirement that the Push Notification user service be running, which is the default on client SKUs but can be disabled on hardened servers.

The CVSS 3.1 base score of 7.8 reflects local attack vector (AV:L), high attack complexity (AC:H), low privileges required (PR:L), no user interaction (UI:N), scope change (S:C), and high impact across CIA - meaning a logged-in standard user could escape into another security domain (likely SYSTEM). The high attack complexity (AC:H) reflects the inherent timing-window difficulty of race condition exploitation, which often requires repeated attempts and precise scheduling. EPSS and KEV data are not provided in the input, so real-world exploitation probability cannot be quantitatively assessed; the lack of a CISA KEV listing combined with no public POC suggests this is currently a theoretical-but-real risk rather than an active campaign. Microsoft-reported and Microsoft-patched flaws in core Windows services warrant prompt patching even without confirmed exploitation, particularly on multi-user systems and endpoints where local code execution by low-privileged users is plausible.

An authenticated low-privileged user - for example, a standard domain user on a shared workstation or a low-privilege service account on a multi-tenant terminal server - runs a crafted binary that repeatedly triggers operations against the Windows Push Notification subsystem while a second thread races to swap or modify the shared resource between validation and use. After winning the race, the attacker pivots from limited user to SYSTEM, enabling credential theft from LSASS, installation of persistence, and lateral movement. No public POC has been identified at time of analysis.