Executive brief
A security vulnerability exists in the Windows Local Session Manager, a component responsible for managing user sessions on a computer. An attacker who already has basic access to a system could exploit a timing error to gain full administrative control. This could allow them to access sensitive data, install malicious software, or disrupt business operations.
Technical details
A race condition vulnerability (CWE-362) exists in the Windows Local Session Manager (LSM) due to improper synchronization when accessing shared resources. To exploit this, an attacker must first have local access to the target system with low-level user privileges. By successfully winning the race condition during concurrent execution, the attacker can elevate their privileges to SYSTEM or Administrator level. The attack complexity is considered high because it requires specific timing to exploit the shared resource conflict. Microsoft has released security updates to address this issue across affected Windows and Windows Server versions.
Affected products
- Microsoft Windows 10 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 22H3, 23H2, 24H2, 25H2
- Microsoft Windows Server 2008 R2 Service Pack 1
Timeline
- 2026-01-13: advisory: Initial disclosure by Microsoft and NVD