Executive brief
Windows Win32K, the graphics and windowing subsystem at the core of the Windows operating system, contains a race condition in resource handling. An authenticated attacker with local access could exploit this flaw to bypass a security feature, potentially allowing unauthorized privilege elevation or system manipulation on affected computers.
Technical details
This vulnerability is a race condition (CWE-362) in Microsoft Windows Win32K caused by improper synchronization when accessing shared resources. The flaw requires local access and prior authentication on the target system. An attacker could exploit the timing window between resource checks to bypass a security control. The vulnerability does not appear to be actively exploited in the wild, and patches are expected to be available through Microsoft Security Updates.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed