CVE-2026-58527: Microsoft Windows Runtime privilege escalation via race condition

CVE-2026-58527 · Severity: high · CVSS 7.8 · Published 2026-07-14

A security vulnerability exists in the Windows Runtime, a core component of the Windows operating system used for running modern applications. An attacker who already has basic access to a computer could exploit this flaw to gain full administrative control over the system. This could allow them to access sensitive data, install malicious software, or disrupt business operations.

Technologies: Microsoft Windows 11, Microsoft Windows Server 2022, Microsoft Windows Server 2025. Vendors: Microsoft.

Quick answers

Is CVE-2026-58527 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-58527 being exploited in the wild.
How severe is CVE-2026-58527?
High severity, with a CVSS score of 7.8, published 14 July 2026.
Which products and versions are affected?
Microsoft Windows 11 10.0.26100.0 to 10.0.26100.8875; Microsoft Windows Server 2022 10.0.20348.0 to 10.0.20348.5386; Microsoft Windows Server 2025 10.0.26100.0 to 10.0.26100.33158.
Is there a fix for CVE-2026-58527?
A patch was published on 2026-07-14: Security updates released for affected Windows versions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-58527 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-58527?
Check whether you run Microsoft Windows 11, Microsoft Windows Server 2022 or Microsoft Windows Server 2025 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A race condition (CWE-362) exists in the Windows Runtime due to improper synchronization during concurrent execution using a shared resource. The vulnerability is exploitable by a locally authenticated attacker with low privileges. By successfully winning the race condition, the attacker can achieve local privilege escalation (LPE), gaining SYSTEM-level access or equivalent high-level permissions. The flaw affects multiple versions of Windows 11 and Windows Server, and Microsoft has released security updates to address the issue.

Affected products

  • Microsoft Windows 11 Version 24H2 10.0.26100.0 to 10.0.26100.8875
  • Microsoft Windows 11 Version 25H2 10.0.26200.0 to 10.0.26100.8875
  • Microsoft Windows 11 version 26H1 10.0.28000.0 to 10.0.28000.2525
  • Microsoft Windows Server 2022 10.0.20348.0 to 10.0.20348.5386
  • Microsoft Windows Server 2025 10.0.26100.0 to 10.0.26100.33158

Timeline

  • 2026-07-14: advisory: Initial advisory published by Microsoft and NVD.
  • 2026-07-14: patched: Security updates released for affected Windows versions.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.