CVE-2026-20873

HighCVSS 7.8/10Last modified Jul 30, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-362 CWE-416

Affected software

Vendor	Product	Versions
Microsoft	Windows 10 Version 1809	>= 10.0.17763.0, < 10.0.17763.8276
Microsoft	Windows 10 Version 21H2	>= 10.0.19044.0, < 10.0.19044.6809
Microsoft	Windows 10 Version 22H2	>= 10.0.19045.0, < 10.0.19045.6809
Microsoft	Windows 11 version 23H2	>= 10.0.22631.0, < 10.0.22631.6491
Microsoft	Windows 11 Version 23H2	>= 10.0.22631.0, < 10.0.22631.6491
Microsoft	Windows 11 Version 24H2	>= 10.0.26100.0, < 10.0.26100.7623
Microsoft	Windows 11 Version 25H2	>= 10.0.26200.0, < 10.0.26200.7623
Microsoft	Windows Server 2019	>= 10.0.17763.0, < 10.0.17763.8276
Microsoft	Windows Server 2019 (Server Core installation)	>= 10.0.17763.0, < 10.0.17763.8276
Microsoft	Windows Server 2022	>= 10.0.20348.0, < 10.0.20348.4648
Microsoft	Windows Server 2022, 23H2 Edition (Server Core installation)	>= 10.0.25398.0, < 10.0.25398.2092
Microsoft	Windows Server 2025	>= 10.0.26100.0, < 10.0.26100.32230
Microsoft	Windows Server 2025 (Server Core installation)	>= 10.0.26100.0, < 10.0.26100.32230

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20873Vendor Advisory

Timeline

Published: Jan 13, 2026
Last modified: Jul 30, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-208747.8Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authori CVE-2026-208757.5Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over CVE-2026-208766.7Heap-based buffer overflow in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locall CVE-2026-208777.8Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.CVE-2026-208787.4Null pointer dereference for some Intel(R) PROSet/Wireless WiFi Software for Windows within Ring 2: Device Drivers may allow a denial of ser CVE-2026-208798.3Out-of-bounds write for the Intel(R) Data Center Graphics Driver for VMware ESXi software before version 2.0.2 within Ring 1: Device Drivers CVE-2026-20889.8A vulnerability has been found in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown part of the file /admin/accepted-CVE-2026-208805.4Incorrect default permissions for some Intel(R) Graphics Driver software installers within Ring 3: User Applications may allow an escalation CVE-2026-208815.5Divide by zero for some Intel(R) QAT software drivers for Windows before version 1.13 within Ring 3: User Applications may allow a denial of CVE-2026-208827.5The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting m CVE-2026-208836.5Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private repository is revoked, they may CVE-2026-208849.8An integer overflow vulnerability exists in the deflate_dng_load_raw functionality of LibRaw Commit 8dc68e2. A specially crafted malicious f