Executive brief
A security vulnerability exists in the Windows Runtime, a core component of the Windows operating system used by applications to interact with the system. An unauthorized attacker could exploit this flaw to gain higher-level system permissions, potentially allowing them to access sensitive data or disrupt operations. While the attack can be launched over a network, it requires specific timing conditions to be met, making it more difficult to execute successfully than typical attacks.
Technical details
This vulnerability is a race condition (CWE-362) within the Windows Runtime (WinRT) component, which can lead to a use-after-free (CWE-416) scenario. The flaw is caused by improper synchronization when multiple threads or processes access shared resources concurrently. An unauthenticated attacker can exploit this over the network to achieve elevation of privilege. Although the attack vector is network-based, the attack complexity is rated as high due to the precise timing required to trigger the race condition. Microsoft has released security updates for affected versions of Windows 10, Windows 11, and Windows Server.
Affected products
- Microsoft Windows 10 Version 1809 10.0.17763.0 to 10.0.17763.9020
- Microsoft Windows 10 Version 21H2 10.0.19044.0 to 10.0.19044.7548
- Microsoft Windows 10 Version 22H2 10.0.19045.0 to 10.0.19045.7548
- Microsoft Windows 11 Version 24H2 10.0.26100.0 to 10.0.26100.8875
- Microsoft Windows 11 Version 25H2 10.0.26200.0 to 10.0.26200.8875
- Microsoft Windows 11 version 26H1 10.0.28000.0 to 10.0.28000.2269
- Microsoft Windows Server 2019 10.0.17763.0 to 10.0.17763.9020
- Microsoft Windows Server 2022 10.0.20348.0 to 10.0.20348.5386
Timeline
- 2026-07-14: advisory: Initial publication by Microsoft and NVD
- 2026-07-14: patched: Security updates made available by Microsoft