CVE-2026-27918

HighCVSS 7.0/10Last modified Oct 14, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published: Apr 14, 2026
Last modified: Oct 14, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-279197.8Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges loca CVE-2026-27929.8Memory safety bugs present in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence CVE-2026-279207.8Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges loca CVE-2026-279217.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker CVE-2026-279227.0Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.CVE-2026-279237.8Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.CVE-2026-279247.8Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.CVE-2026-279256.5Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to disclose information over an adjacen CVE-2026-279267.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Cloud Files Mini Filter Driver allows CVE-2026-279277.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Projected File System allows an autho CVE-2026-279288.7Improper input validation in Windows Hello allows an unauthorized attacker to bypass a security feature over a network.CVE-2026-279297.0Time-of-check time-of-use (toctou) race condition in Windows LUAFV allows an authorized attacker to elevate privileges locally.