Executive brief
A security vulnerability exists in the Windows graphics component (Win32K) that could allow a user with limited access to gain full administrative control over a computer. This issue stems from how the system handles multiple simultaneous requests for the same resource. An attacker who already has a way to run basic commands on a system could use this flaw to bypass security restrictions, access sensitive data, or install malicious software.
Technical details
A race condition vulnerability (CWE-362) exists in the Windows Win32K - GRFX component due to improper synchronization when accessing shared resources. The flaw can lead to a use-after-free (CWE-416) scenario. An attacker must have local access and the ability to execute code with low privileges to exploit this vulnerability. Successful exploitation allows the attacker to elevate their privileges to SYSTEM or another high-level account. The attack requires a specific timing window (high complexity) but does not require user interaction. Microsoft has released security updates to address this issue across affected Windows and Windows Server versions.
Affected products
- Microsoft Windows 10 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 22H3, 23H2, 24H2, 25H2, 26H1
- Microsoft Windows Server 2012 R2
Timeline
- 2026-04-14: disclosed
- 2026-04-14: advisory