CVE-2026-20826

HighCVSS 7.0/10Last modified Jul 30, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Tablet Windows User Interface (TWINUI) Subsystem allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

Vendor	Product	Versions
Microsoft	Windows 10 Version 1607	>= 10.0.14393.0, < 10.0.14393.8783
Microsoft	Windows 10 Version 1809	>= 10.0.17763.0, < 10.0.17763.8276
Microsoft	Windows 10 Version 21H2	>= 10.0.19044.0, < 10.0.19044.6809
Microsoft	Windows 10 Version 22H2	>= 10.0.19045.0, < 10.0.19045.6809
Microsoft	Windows 11 version 23H2	>= 10.0.22631.0, < 10.0.22631.6491
Microsoft	Windows 11 Version 23H2	>= 10.0.22631.0, < 10.0.22631.6491
Microsoft	Windows 11 Version 24H2	>= 10.0.26100.0, < 10.0.26100.7623
Microsoft	Windows 11 Version 25H2	>= 10.0.26200.0, < 10.0.26200.7623
Microsoft	Windows Server 2016	>= 10.0.14393.0, < 10.0.14393.8783
Microsoft	Windows Server 2016 (Server Core installation)	>= 10.0.14393.0, < 10.0.14393.8783
Microsoft	Windows Server 2019	>= 10.0.17763.0, < 10.0.17763.8276
Microsoft	Windows Server 2019 (Server Core installation)	>= 10.0.17763.0, < 10.0.17763.8276
Microsoft	Windows Server 2022	>= 10.0.20348.0, < 10.0.20348.4648
Microsoft	Windows Server 2022, 23H2 Edition (Server Core installation)	>= 10.0.25398.0, < 10.0.25398.2092
Microsoft	Windows Server 2025	>= 10.0.26100.0, < 10.0.26100.32230
Microsoft	Windows Server 2025 (Server Core installation)	>= 10.0.26100.0, < 10.0.26100.32230

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20826Vendor Advisory

Timeline

Published: Jan 13, 2026
Last modified: Jul 30, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-208275.5Exposure of sensitive information to an unauthorized actor in Tablet Windows User Interface (TWINUI) Subsystem allows an authorized attacker CVE-2026-208284.6Out-of-bounds read in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to disclose information with a physical atta CVE-2026-208295.5Out-of-bounds read in Windows TPM allows an authorized attacker to disclose information locally.CVE-2026-20839.8A security flaw has been discovered in code-projects Social Networking Site 1.0. This affects an unknown function of the file /delete_post.p CVE-2026-208307.0Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc)CVE-2026-208317.0Time-of-check time-of-use (toctou) race condition in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate CVE-2026-208327.8Windows Remote Procedure Call Interface Definition Language (IDL) Elevation of Privilege Vulnerability CVE-2026-208335.5Use of a broken or risky cryptographic algorithm in Windows Kerberos allows an authorized attacker to disclose information locally.CVE-2026-208344.6Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack.CVE-2026-208355.5Out-of-bounds read in Capability Access Management Service (camsvc) allows an authorized attacker to disclose information locally.CVE-2026-208367.0Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker CVE-2026-208377.8Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code locally.