CVE-2026-32093

HighCVSS 7.0/10Last modified Oct 26, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-122CWE-362CWE-367

Affected software

VendorProductVersions
MicrosoftWindows 10 Version 1607>= 10.0.14393.0, < 10.0.14393.9060
MicrosoftWindows 10 Version 1809>= 10.0.17763.0, < 10.0.17763.8644
MicrosoftWindows 10 Version 21H2>= 10.0.19044.0, < 10.0.19044.7184
MicrosoftWindows 10 Version 22H2>= 10.0.19045.0, < 10.0.19045.7184
MicrosoftWindows 11 version 23H2>= 10.0.22631.0, < 10.0.22631.6936
MicrosoftWindows 11 Version 23H2>= 10.0.22631.0, < 10.0.22631.6936
MicrosoftWindows 11 Version 24H2>= 10.0.26100.0, < 10.0.26100.8246
MicrosoftWindows 11 Version 25H2>= 10.0.26200.0, < 10.0.26200.8246
MicrosoftWindows 11 version 26H1>= 10.0.28000.0, < 10.0.28000.1836
MicrosoftWindows Server 2012>= 6.2.9200.0, < 6.2.9200.26026
MicrosoftWindows Server 2012 (Server Core installation)>= 6.2.9200.0, < 6.2.9200.26026
MicrosoftWindows Server 2012 R2>= 6.3.9600.0, < 6.3.9600.23132
MicrosoftWindows Server 2012 R2 (Server Core installation)>= 6.3.9600.0, < 6.3.9600.23132
MicrosoftWindows Server 2016>= 10.0.14393.0, < 10.0.14393.9060
MicrosoftWindows Server 2016 (Server Core installation)>= 10.0.14393.0, < 10.0.14393.9060
MicrosoftWindows Server 2019>= 10.0.17763.0, < 10.0.17763.8644
MicrosoftWindows Server 2019 (Server Core installation)>= 10.0.17763.0, < 10.0.17763.8644
MicrosoftWindows Server 2022>= 10.0.20348.0, < 10.0.20348.5020
MicrosoftWindows Server 2022, 23H2 Edition (Server Core installation)>= 10.0.25398.0, < 10.0.25398.2274
MicrosoftWindows Server 2025>= 10.0.26100.0, < 10.0.26100.32690
MicrosoftWindows Server 2025 (Server Core installation)>= 10.0.26100.0, < 10.0.26100.32690

References

Timeline

Published
Apr 14, 2026
Last modified
Oct 26, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-320946.5Shescape is a simple shell escape library for JavaScript. Prior to 2.1.10, Shescape#escape() does not escape square-bracket glob syntax for CVE-2026-320955.4Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.1, Plunk's image upload endpoint accepted SVG files, which browCVE-2026-320968.6Plunk is an open-source email platform built on top of AWS SES. Prior to 0.7.0, a Server-Side Request Forgery (SSRF) vulnerability existed iCVE-2026-320978.8PingPong is a platform for using large language models (LLMs) for teaching and learning. Prior to 7.27.2, an authenticated user may be able CVE-2026-320987.5Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.9 and 8.6.35, aCVE-2026-320996.5Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, when a user has `hide_profile`CVE-2026-32105.3Incorrect Authorization vulnerability in Drupal Material Icons allows Forceful Browsing.This issue affects Material Icons: from 0.0.0 beforeCVE-2026-321005.3Shopware is an open commerce platform. /api/_info/config route exposes information about active security fixes. This vulnerability is fixed CVE-2026-321016.3StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorizedCVE-2026-321026.5OliveTin gives access to predefined shell commands from a web interface. In 3000.10.2 and earlier, OliveTin’s live EventStream broadcasts exCVE-2026-321037.2StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the POST /studiocms_api/dashboard/creCVE-2026-321045.4StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the updateUserNotifications endpoint
CVE-2026-32093: High severity, CVSS 7.0 | Vulnix