CVE-2026-20826

HighCVSS 7.0/10Last modified Jul 30, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Tablet Windows User Interface (TWINUI) Subsystem allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published: Jan 13, 2026
Last modified: Jul 30, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-208275.5Exposure of sensitive information to an unauthorized actor in Tablet Windows User Interface (TWINUI) Subsystem allows an authorized attacker CVE-2026-208284.6Out-of-bounds read in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to disclose information with a physical atta CVE-2026-208295.5Out-of-bounds read in Windows TPM allows an authorized attacker to disclose information locally.CVE-2026-20839.8A security flaw has been discovered in code-projects Social Networking Site 1.0. This affects an unknown function of the file /delete_post.p CVE-2026-208307.0Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc)CVE-2026-208317.0Time-of-check time-of-use (toctou) race condition in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate CVE-2026-208327.8Windows Remote Procedure Call Interface Definition Language (IDL) Elevation of Privilege Vulnerability CVE-2026-208335.5Use of a broken or risky cryptographic algorithm in Windows Kerberos allows an authorized attacker to disclose information locally.CVE-2026-208344.6Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack.CVE-2026-208355.5Out-of-bounds read in Capability Access Management Service (camsvc) allows an authorized attacker to disclose information locally.CVE-2026-208367.0Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker CVE-2026-208377.8Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code locally.