Executive brief
A security vulnerability exists in the Windows Media component of Windows 11 that could allow a user with limited access to gain full administrative control over the system. By exploiting a timing issue in how the system handles media resources, an attacker can bypass security restrictions to run malicious code with elevated permissions. This could lead to a complete compromise of the affected computer, including unauthorized access to sensitive data and system settings.
Technical details
This vulnerability is classified as a race condition (CWE-362) leading to a use-after-free (CWE-416) scenario within the Windows Media component. An attacker with low-privileged local access can exploit improper synchronization of shared resources during concurrent execution. Successful exploitation requires the attacker to win a timing race, which, if successful, allows for local privilege escalation (LPE) to SYSTEM level. The attack complexity is considered high due to the precise timing required for the race condition. Microsoft has released security updates to address this issue across affected Windows 11 versions.
Affected products
- Microsoft Windows 11 Version 24H2 10.0.26100.0 to 10.0.26100.8875
- Microsoft Windows 11 Version 25H2 10.0.26200.0 to 10.0.26200.8875
- Microsoft Windows 11 version 26H1 10.0.28000.0 to 10.0.28000.2269
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory