Executive brief
A security vulnerability exists in Windows Management Services, a core component used for managing and monitoring Windows operating systems. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to access sensitive data, install malicious software, or disrupt business operations.
Technical details
A race condition (CWE-362) and associated use-after-free (CWE-416) vulnerability exist in Windows Management Services due to improper synchronization when accessing shared resources. The attack requires a local attacker to have low-level execution privileges and involves a complex timing-based exploit (High Attack Complexity) to trigger the synchronization error. Successful exploitation allows the attacker to escape their current privilege level and gain SYSTEM-level access, impacting confidentiality, integrity, and availability. Microsoft has released security updates to address this issue across affected Windows and Windows Server versions.
Affected products
- Microsoft Windows 10 1809, 21H2, 22H2
- Microsoft Windows 11 22H3, 23H2, 24H2, 25H2
- Microsoft Windows Server 2019 All versions
- Microsoft Windows Server 2022 All versions
Timeline
- 2026-01-13: disclosed
- 2026-01-13: advisory