EUVD-2026-43920
GHSA-g784-2pg8-v3q9
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation needing an existing low-priv account (PR:L) and winning a timing race (AC:H); successful escalation yields full local compromise (C:H/I:H/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Runtime component of Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025 allows an already-authenticated local attacker to win a race condition and gain higher privileges. The flaw was reported by Microsoft, which has released a patch; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The high CVSS complexity (AC:H) reflects that the attacker must reliably win a timing window, tempering real-world exploitability despite the full compromise of confidentiality, integrity, and availability once triggered.
Technical ContextAI
The vulnerability lies in the Windows Runtime (WinRT), the object-oriented API layer underpinning modern Windows application platform features and inter-process/component activation across Windows 11 and Windows Server 2025. The root cause is CWE-362, concurrent execution using a shared resource with improper synchronization (a race condition): two or more threads or processes access a shared resource without adequate locking, allowing an attacker to manipulate state during the unsynchronized window (a classic time-of-check-to-time-of-use style flaw). The CPE data confirms the affected surface is the OS runtime on Windows 11 versions 24H2/25H2/26H1, Windows Server 2025, and its Server Core installation, indicating this is a core platform component rather than an add-on product.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update for CVE-2026-50403 as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50403, selecting the KB corresponding to your specific Windows 11 (24H2/25H2/26H1) or Windows Server 2025 build (including Server Core). No exact fixed version string was provided in the input, so obtain the precise KB/build from the MSRC page before deployment. Because exploitation requires a local authenticated foothold, compensating controls while patching include enforcing least privilege to reduce the pool of low-privileged accounts that could stage an attack, restricting interactive and local logon rights on servers, and monitoring for anomalous local process/thread activity indicative of race-condition exploitation attempts; these controls reduce opportunity but do not close the flaw, so patching remains the definitive fix.
More in Windows Server 2025
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a
Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute
Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today