Executive brief
A security vulnerability exists in the Windows Runtime, a core component of the Windows operating system used by applications to interact with the system. An attacker who already has basic access to a computer could exploit this flaw to gain higher-level administrative privileges. This could allow them to take full control of the affected system, potentially leading to unauthorized data access or service disruption.
Technical details
This vulnerability is a race condition (CWE-362) in the Windows Runtime (WinRT) component that can lead to a use-after-free (CWE-416) scenario. An attacker with low-privileged local access can exploit improper synchronization during concurrent execution using shared resources. Successful exploitation allows the attacker to elevate privileges, potentially gaining SYSTEM-level access. The attack requires the attacker to win a timing window (high complexity) but does not require user interaction. Microsoft has released security updates to address this issue across affected Windows 11 and Windows Server 2025 versions.
Affected products
- Microsoft Windows 11 Version 24H2 10.0.26100.0 to 10.0.26100.8875
- Microsoft Windows 11 Version 25H2 10.0.26200.0 to 10.0.26200.8875
- Microsoft Windows 11 version 26H1 10.0.28000.0 to 10.0.28000.2269
- Microsoft Windows Server 2025 10.0.26100.0 to 10.0.26100.33158
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory