EUVD-2026-43919
GHSA-w3hg-m9hj-8hr8
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable with no auth or interaction (AV:N/PR:N/UI:N) but AC:H because a race window must be won; authentication bypass yields full C:H/I:H/A:H.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an unauthorized attacker to elevate privileges over a network.
AnalysisAI
Elevation of privilege in Microsoft Windows Runtime (WinRT) lets a remote, unauthenticated attacker win a timing window in a shared-resource race condition and gain higher privileges across a broad range of Windows client and server releases (Windows 10 1809 through Windows 11 26H1 and Windows Server 2019/2022/2025). Microsoft-reported and patched, the flaw carries CVSS 8.1, driven by full confidentiality, integrity, and availability impact but tempered by high attack complexity. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
Windows Runtime (WinRT) is the object/component model and API surface underlying modern Windows apps and many OS services, shared across client and server SKUs. The root cause is CWE-362, concurrent execution using a shared resource with improper synchronization (a race condition): two or more threads or requests access the same resource without adequate locking, creating a narrow window in which state can be manipulated between check and use. Per the input tags this race is leveraged as an authentication bypass, allowing an attacker who reaches the affected code path over the network to subvert a privilege or authorization decision. The affected CPE set spans Windows 10 Version 1809/21H2/22H2, Windows 11 24H2/25H2/26H1, and Windows Server 2019, 2022, and 2025 (including Server Core), indicating the vulnerable component ships in the base OS rather than an optional feature.
RemediationAI
Apply the Microsoft security update for CVE-2026-50460 via Windows Update or WSUS/SCCM; a vendor patch is available and Microsoft publishes the exact fixed build per affected SKU in its advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50460 - apply the KB matching each Windows 10/11 or Windows Server 2019/2022/2025 release, including Server Core hosts. Because exact per-build fix versions are enumerated only in the MSRC update guide, consult that page to confirm the patched build for your environment rather than relying on a single version string. Until patching completes, reduce network exposure of affected hosts by restricting inbound access to the Windows Runtime-backed service through host and perimeter firewalls and network segmentation so only trusted management networks can reach it; the trade-off is potential disruption to legitimate remote clients or management tooling that depend on that service, so validate connectivity requirements before applying blocks. Prioritize internet-facing servers and domain controllers.
More in Windows Server 2019
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Win32k contains an out-of-bounds write vulnerability enabling local privilege escalation to SYSTEM, exploited by
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Same weakness CWE-362 – Race Condition
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today