Executive brief
A security vulnerability exists in Windows Management Services, a core component used for managing and monitoring Windows systems. An attacker who already has basic access to a computer could exploit a timing flaw to gain full administrative control. This could allow them to view sensitive data, change system settings, or disable security protections.
Technical details
A race condition vulnerability (CWE-362) exists in Windows Management Services due to improper synchronization when accessing shared resources. The flaw may involve memory safety issues such as Use-After-Free (CWE-416) or Double Free (CWE-415) during concurrent execution. An attacker with local access and low privileges can exploit this timing window to achieve SYSTEM-level privileges. The attack requires high complexity to successfully time the race condition but does not require user interaction. Microsoft has released security updates to address this issue across affected Windows 10, 11, and Server versions.
Affected products
- Microsoft Windows 10 Version 1809 10.0.17763.0 to 10.0.17763.8276
- Microsoft Windows 10 Version 21H2 10.0.19044.0 to 10.0.19044.6809
- Microsoft Windows 10 Version 22H2 10.0.19045.0 to 10.0.19045.6809
- Microsoft Windows 11 Version 22H3 10.0.22631.0 to 10.0.22631.6491
- Microsoft Windows 11 Version 23H2 10.0.22631.0 to 10.0.22631.6491
- Microsoft Windows 11 Version 24H2 10.0.26100.0 to 10.0.26100.7623
- Microsoft Windows 11 Version 25H2 10.0.26200.0 to 10.0.26200.7623
- Microsoft Windows Server 2019 10.0.17763.0 to 10.0.17763.8276
- Microsoft Windows Server 2022 Up to 10.0.20348.x (truncated)
Timeline
- 2026-01-13: advisory: Initial disclosure by Microsoft and NVD
- 2026-07-30: other: Vulnerability record modified by Microsoft