Windows Runtime EUVD-2026-43894

Exploitation requires network reachability to the vulnerable Windows Runtime service on an unpatched host and the ability to issue concurrent requests to trigger the race condition; per the CVSS vector (AV:N/AC:H/PR:N/UI:N) no prior authentication or user interaction is needed. The dominant limiting factor is AC:H: success depends on winning a timing-sensitive race between threads accessing shared state, which is non-deterministic and cannot be reliably automated (SSVC Automatable: no), so exploitation typically demands many repeated attempts and favorable scheduling conditions. Note the data tension - the description describes privilege elevation 'over a network,' so confirm the exact reachable endpoint and whether specific WinRT/RPC services must be exposed with Microsoft's advisory.

Signals are mixed and point to a serious-but-not-emergency issue. The CVSS 8.1 (High) reflects AV:N with total impact (C:H/I:H/A:H) and no privileges or user interaction required, but AC:H is significant - winning a race condition is timing-dependent and non-deterministic, which materially lowers reliability of exploitation. This is corroborated by CISA SSVC marking the vulnerability Automatable: no (attackers cannot reliably script mass exploitation) despite Technical Impact: total, and by a low EPSS of 0.33% (25th percentile). There is no evidence of active exploitation (SSVC Exploitation: none; not in KEV) and no public exploit identified. A notable tension exists in the data: the description states privilege elevation 'over a network' with PR:N, yet EoP over a network is unusual and the 'Authentication Bypass' tagging implies the attacker gains authorization rather than local rights - verify the precise attack surface with Microsoft. Net: patch on a normal-to-prioritized cadence given ubiquity and total impact, but the AC:H and no-automatable rating argue against treating it as a drop-everything zero-day.

A remote attacker with network reach to an unpatched Windows host repeatedly and concurrently invokes the affected WinRT operation, racing two requests to slip past an authorization check during the narrow check-to-use window. On a successful race, the attacker bypasses authentication and obtains elevated privileges with full read/write/impact on the target. No public proof-of-concept is available, and the AC:H timing dependence means many attempts may be needed for a single success.