CVE-2026-48572

HighCVSS 7.0/10Last modified Jul 16, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Installer allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362CWE-416

Affected software

No affected versions have been published.

Timeline

Published
Jul 14, 2026
Last modified
Jul 16, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-485737.9No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.CVE-2026-485747.8Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code locally.CVE-2026-485757.9Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.CVE-2026-485767.9No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.CVE-2026-485787.9Improper access control in Windows Secure Boot allows an authorized attacker to elevate privileges locally.CVE-2026-485797.5Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a network.CVE-2026-48589.9Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversCVE-2026-485805.5Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.CVE-2026-485817.8Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.CVE-2026-485829.6Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.CVE-2026-485837.8Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-485848.8Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate privileges over a network.
CVE-2026-48572: High severity, CVSS 7.0 | Vulnix