CVE-2026-50356

HighCVSS 7.0/10Last modified Jul 23, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published
Jul 14, 2026
Last modified
Jul 23, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-503577.8Numeric truncation error in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.CVE-2026-503587.8Use after free in Windows Media allows an authorized attacker to elevate privileges locally.CVE-2026-503597.8Use after free in Microsoft XML Core Services allows an authorized attacker to elevate privileges locally.CVE-2026-50368.8A vulnerability was found in Tenda 4G06 04.06.01.29. This vulnerability affects the function fromDhcpListClient of the file /goform/DhcpListCVE-2026-503608.8Incorrect implementation of authentication algorithm in Windows SMB Server allows an authorized attacker to elevate privileges over a networCVE-2026-503617.8Double free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.CVE-2026-503627.8Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an unauthorized attacker to execute code locally.CVE-2026-503637.8Heap-based buffer overflow in Windows Push Notifications allows an authorized attacker to elevate privileges locally.CVE-2026-503647.3Improper link resolution before file access ('link following') in Windows Server Backup allows an authorized attacker to elevate privileges CVE-2026-503658.0Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent network.CVE-2026-503666.5Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.CVE-2026-503677.8Incorrect access of indexable resource ('range error') in Windows Sensor Data Service allows an authorized attacker to elevate privileges lo