CVE-2026-25184

HighCVSS 7.0/10Last modified Oct 14, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Applocker Filter Driver (applockerfltr.sys) allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published: Apr 14, 2026
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-251855.3Exposure of sensitive information to an unauthorized actor in Windows Shell Link Processing allows an unauthorized attacker to perform spoof CVE-2026-251865.5Exposure of sensitive information to an unauthorized actor in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attac CVE-2026-251877.8Improper link resolution before file access ('link following') in Winlogon allows an authorized attacker to elevate privileges locally.CVE-2026-251888.8Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to elevate privileges over an adjacent network.CVE-2026-251897.8Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.CVE-2026-25195.3The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to price manipulation via the 'tips' parame CVE-2026-251907.8Untrusted search path in Windows GDI allows an unauthorized attacker to execute code locally.CVE-2026-251918.4The installer of FinalCode Client provided by Digital Arts Inc. contains an issue with the DLL search path. If a user is directed to place a CVE-2026-251929.8WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate d CVE-2026-251938.6Insertion of Sensitive Information into Log File (CWE-532) in some Command Centre Service installers could lead to Service Account credentia CVE-2026-251941.8Out-of-bounds write in the firmware for the Intel(R) Slim Bootloader may allow a denial of service. System software adversary with a privile CVE-2026-251956.6An OS command injection vulnerability exists in XWEB Pro version 1.12.1 and prior, enabling an authenticated attacker to achieve remote