Executive brief
A time-of-check time-of-use (TOCTOU) race condition exists in the Windows Kernel that allows an authenticated user to elevate their privileges to a higher level on a local system. An attacker with a valid user account could exploit this vulnerability to gain system-level access, potentially compromising the entire machine and any data or services it hosts.
Technical details
A TOCTOU race condition vulnerability in the Windows Kernel allows an authorized local attacker to escalate privileges. The vulnerability occurs when a security check (time-of-check) is performed and the resource is accessed later (time-of-use), leaving a window where conditions can change. The attacker must have local access and valid credentials on the target system. Successful exploitation allows the attacker to execute code with elevated privileges, potentially gaining SYSTEM-level access. Microsoft has released a security patch to address this vulnerability.
Affected products
- Microsoft Windows Kernel
Timeline
- 2026-09-08: disclosed