EUVD-2026-43791
GHSA-gr87-xh8q-83qf
Severity by source
AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Local EoP needing an authenticated user (PR:L) and a hard-to-win race (AC:H); privileged code execution yields full C/I/A and a changed scope (S:C).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Push Notifications component (WPN) affects Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2025 including Server Core, where a race condition (CWE-362) lets an authorized local user win a timing window on a shared resource to run code at a higher privilege level. Microsoft reported the issue and has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an existing authenticated local foothold (CVSS PR:L) on an affected build - Windows 11 23H2/24H2/25H2/26H1 or Windows Server 2025 - and the ability to execute code locally to drive the Windows Push Notifications subsystem; it cannot be triggered remotely (AV:L) and needs no user interaction (UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H - local attack vector, high attack complexity, low privileges required, no user interaction, changed scope and high confidentiality/integrity/availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who already has a low-privileged authenticated session on a Windows 11 or Windows Server 2025 host runs a local program that repeatedly triggers Push Notification operations while racing a second thread to manipulate the shared resource during the unsynchronized window. On a successful timing win, the operation executes in a higher-privileged context, giving the attacker SYSTEM-level code execution and crossing the security scope boundary. … |
| Remediation | Apply the Microsoft security update for the affected SKU as the primary fix - a vendor patch is available per the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-44800; deploy the corresponding monthly cumulative update for Windows 11 (23H2/24H2/25H2/26H1) or Windows Server 2025 (including Server Core) via Windows Update, WSUS, or your patch-management pipeline, and reboot to complete servicing. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Windows Server 2025 and Windows 11 systems running affected versions, prioritizing production servers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Windows 11 Version 23H2
View allRemote code execution in the Microsoft Windows FTP Service allows an unauthenticated network attacker to run arbitrary c
Remote code execution in the Microsoft ODBC Driver for SQL Server (shipped across Windows 10, Windows 11, and Windows Se
Local privilege escalation in the Windows Virtual Hard Disk (VHD) Miniport Driver lets an authenticated low-privileged u
Local privilege escalation in Windows Kernel across Windows 10, Windows 11 (versions 22H3 through 26H1), and Windows Ser
Local privilege escalation via a heap-based buffer overflow in the Windows NTFS driver allows an authenticated attacker
Local privilege escalation in Windows Secure Kernel Mode (SKM/VTL1) allows an already-authenticated attacker to elevate
Local code execution in Microsoft Windows NTFS (the New Technology File System driver) arises from a heap-based buffer o
Denial of service in the Windows Local Security Authority Subsystem Service (LSASS) allows a remote, unauthenticated att
Local privilege elevation in the Windows WebView component affects a broad range of currently-supported Windows client a
Local privilege escalation in the Windows DirectX graphics subsystem allows an authenticated attacker with low privilege
Local privilege escalation in Microsoft Windows App Installer (the AppX/MSIX deployment component) lets a low-privileged
Local privilege escalation in Windows App Installer (App Installer / MSIX handler) on Windows 11 (23H2 through 26H1) and
Same weakness CWE-362 – Race Condition
View allSame technique Race Condition
View allShare
External POC / Exploit Code
Leaving vuln.today