Windows Push Notifications EUVD-2026-56344

The attacker must hold a low-privileged local user account on the target Windows system (confirmed by PR:L in CVSS vector), obtainable through interactive logon, remote desktop access, or prior remote code execution as an unprivileged process. Exploitation is local-only (AV:L) - remote unauthenticated access to trigger this vulnerability is not possible. The race condition requires winning a precise thread-scheduling timing window (AC:H), making exploitation non-deterministic and dependent on system load and scheduler behavior; a single attempt is unlikely to succeed reliably without retry loops. No user interaction is required once the attacker has local access (UI:N). No non-default configuration of Windows Push Notifications is indicated as a prerequisite - the component is enabled by default across all listed Windows editions. Exploitation is bounded to unpatched Windows 10, Windows 11, and Windows Server 2019/2022/2025 builds as listed in the affected versions data.

The CVSS 7.0 score with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H represents a well-calibrated threat: the attack surface is constrained to local, authenticated sessions and requires successfully winning a timing race (AC:H), which lowers mass-exploitation feasibility compared to network-reachable or low-complexity flaws. No EPSS data is present in the available intelligence, and KEV status is not confirmed, suggesting this is not currently under widespread opportunistic exploitation. However, local privilege escalation primitives are highly valued in post-initial-access kill chains - ransomware operators and advanced threat actors routinely chain low-privilege foothold techniques with LPE bugs to achieve SYSTEM before lateral movement. The high CVSS impact triad (C:H/I:H/A:H) means any successful exploitation yields full host compromise. The 'Information Disclosure' tag in the source data is consistent with the C:H metric but secondary to the primary privilege escalation impact. Given the breadth of affected Windows versions and the ubiquity of the platform, even a mid-sized municipal IT team in rybnik should treat this as a standard patch-cycle priority rather than deferring to the next maintenance window, since the prerequisite of low-privileged local access is routinely satisfied once an attacker has a phishing or initial-access foothold. No conflicting signals are present between available data sources.

An attacker who has established a low-privileged foothold on a Windows endpoint - for example through a phishing-delivered implant or exploitation of an exposed remote service - launches a multithreaded exploit that races concurrent threads against the Windows Push Notifications shared resource. By winning the synchronization window under favorable thread scheduling, the attacker corrupts shared state and redirects execution into a privileged context, achieving SYSTEM-level code execution. The AC:H rating reflects that reliable exploitation requires careful timing calibration, and no public exploit code has been identified at time of analysis.