CVE-2026-50503

HighCVSS 7.0/10Last modified Jul 22, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362

Affected software

No affected versions have been published.

Timeline

Published
Jul 14, 2026
Last modified
Jul 22, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-505047.5Buffer over-read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.CVE-2026-505058.8Use after free in Windows Message Queuing allows an authorized attacker to execute code over a network.CVE-2026-505067.5Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.CVE-2026-505076.8Missing authentication for critical function in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physicCVE-2026-505087.5Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a networCVE-2026-505097.8Deserialization of untrusted data in Windows Wireless Wide Area Network Service allows an authorized attacker to elevate privileges locally.CVE-2026-50514.4HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections whCVE-2026-505107.8Improper restriction of names for files and other resources in Github Copilot allows an unauthorized attacker to execute code locally.CVE-2026-505117.8Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges lCVE-2026-505127.8Missing authentication for critical function in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.CVE-2026-505159.9Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network.CVE-2026-505169.4Incorrect authorization in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privileges over a network.
CVE-2026-50503: High severity, CVSS 7.0 | Vulnix