Microsoft Windows EUVD-2026-43900

Exploitation requires the attacker to already have local, interactive execution on the host with low-level (PR:L) privileges - a standard authenticated user account or code running in a non-privileged context; it cannot be triggered remotely or by an unauthenticated party (AV:L, no network path). The core limiting factor is the race condition itself (AC:H): the attacker must reliably win a narrow timing window on an improperly synchronized shared resource, which typically demands many repeated attempts and favorable thread scheduling, and success is probabilistic rather than guaranteed. No user interaction is needed (UI:N) and the vulnerability is present in default configurations of the listed builds, but the requirements for pre-existing local access plus race-timing precision - reflected in the low 0.24% EPSS and SSVC Automatable=no - meaningfully constrain realistic exploitation to attackers with an existing foothold.

The signals converge on a genuine-but-not-urgent local escalation issue. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) requires local access and existing low privileges, and critically marks High attack complexity - meaning reliable exploitation depends on winning a timing race, which is exactly why EPSS sits low at 0.24% (16th percentile). CISA's SSVC framework aligns: Exploitation is 'none' (no observed activity), Automatable is 'no' (the race cannot be mass-scripted reliably), yet Technical Impact is 'total' (full compromise if the race is won). There is no KEV listing and no public exploit identified, so this is not an active-exploitation priority. It is a defense-in-depth patch: a valuable escalation primitive for a local attacker or malware already running on the host, but the high complexity and lack of automation keep real-world mass exploitation improbable. No signals conflict - all sources agree the impact is severe but the exploitation barrier is meaningful.

An attacker who already has a low-privileged foothold on a Windows 11 or Server 2025 host - for example through phishing-delivered malware or a compromised standard user account - runs code that repeatedly triggers the vulnerable OS operation while a second thread manipulates the shared resource to win the timing window. On a successful race, the attacker gains SYSTEM-level privileges, achieving full confidentiality, integrity, and availability compromise of the machine. No public exploit is identified at time of analysis, and the High attack complexity means many attempts may be needed to win the race reliably.