CVE-2026-20853

HighCVSS 7.4/10Last modified Jul 30, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows WalletService allows an unauthorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published
Jan 13, 2026
Last modified
Jul 30, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-208547.5Use after free in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to execute code over a network.CVE-2026-208568.1Improper input validation in Windows Server Update Service allows an unauthorized attacker to execute code over a network.CVE-2026-208577.8Untrusted pointer dereference in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.CVE-2026-208587.8Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.CVE-2026-208597.8Use after free in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.CVE-2026-20868.8A vulnerability was detected in UTT HiPER 810G up to 1.7.7-171114. Affected by this vulnerability is the function strcpy of the file /goformCVE-2026-208607.8Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attackerCVE-2026-208617.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authoriCVE-2026-208625.5Exposure of sensitive information to an unauthorized actor in Windows Management Services allows an authorized attacker to disclose informatCVE-2026-208637.0Double free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.CVE-2026-208647.8Heap-based buffer overflow in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.CVE-2026-208657.8Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.