CVE-2026-58598

HighCVSS 7.0/10Last modified Jul 22, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362CWE-416

Affected software

VendorProductVersions
MicrosoftWindows 10 Version 21H2>= 10.0.19044.0, < 10.0.19044.7548
MicrosoftWindows 10 Version 22H2>= 10.0.19045.0, < 10.0.19045.7548
MicrosoftWindows 11 Version 24H2>= 10.0.26100.0, < 10.0.26100.8875
MicrosoftWindows 11 Version 25H2>= 10.0.26200.0, < 10.0.26200.8875
MicrosoftWindows 11 version 26H1>= 10.0.28000.0, < 10.0.28000.2525

References

Timeline

Published
Jul 16, 2026
Last modified
Jul 22, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-585997.8Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code locally.CVE-2026-58608.8Use after free in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a CVE-2026-586007.8Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to elevate privileges locally.CVE-2026-586017.8Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.CVE-2026-586027.8Use after free in Windows Kernel Mode Driver allows an authorized attacker to elevate privileges locally.CVE-2026-586087.5Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components allows an auCVE-2026-586097.8Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.CVE-2026-58618.8Use after free in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafCVE-2026-586107.8Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code locally.CVE-2026-586117.8Improper authorization in XBox Gaming Services allows an authorized attacker to elevate privileges locally.CVE-2026-586127.5Server-side request forgery (ssrf) in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.CVE-2026-586137.8Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-58598: High severity, CVSS 7.0 | Vulnix