Executive brief
A security vulnerability exists in the way Windows handles wireless networking, which could allow a user with limited access to gain full administrative control over a computer. This issue stems from a synchronization error when the system processes multiple requests simultaneously. If exploited, an attacker could bypass security restrictions to access sensitive data or install malicious software.
Technical details
A race condition (CWE-362) exists in the Windows Wireless Networking component due to improper synchronization when accessing shared resources. An attacker with low-privileged local access can exploit this flaw by timing concurrent executions to trigger a synchronization error. Successful exploitation allows the attacker to elevate privileges, potentially gaining SYSTEM-level access. The attack requires high complexity due to the precise timing needed for the race condition, but it results in a scope change (S:C) affecting the entire operating system. Microsoft has released security updates to address this issue across affected Windows and Windows Server versions.
Affected products
- Microsoft Windows 10 1809, 21H2, 22H2
- Microsoft Windows 11 24H2, 25H2, 26H1
- Microsoft Windows Server 2019 All versions
- Microsoft Windows Server 2022 All versions
Timeline
- 2026-07-14: disclosed: Initial publication by Microsoft and NVD
- 2026-07-14: patched: Security updates made available via Microsoft Security Update Guide