CVE-2026-20867

HighCVSS 7.8/10Last modified Jul 30, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-362 CWE-415 CWE-416

Affected software

No affected versions have been published.

Timeline

Published: Jan 13, 2026
Last modified: Jul 30, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-208688.8Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a networ CVE-2026-208697.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Local Session Manager (LSM) allows an CVE-2026-20879.8A flaw has been found in SourceCodester Online Class Record System 1.0. Affected by this issue is some unknown functionality of the file /ad CVE-2026-208707.8Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.CVE-2026-208717.8Use after free in Desktop Windows Manager allows an authorized attacker to elevate privileges locally.CVE-2026-208726.5External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.CVE-2026-208737.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authori CVE-2026-208747.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authori CVE-2026-208757.5Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over CVE-2026-208766.7Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locall CVE-2026-208777.8Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.CVE-2026-208787.4Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of ser