CVE-2026-85357

HighCVSS 7.0/10Last modified Oct 13, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Phone Service allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362CWE-416

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 13, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-853587.8Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-853597.8Improper control of generation of code ('code injection') in Windows Performance Monitor allows an authorized attacker to elevate privilegesCVE-2026-85363.1Insufficient validation of untrusted input in ReadingMode in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who had CVE-2026-853607.0Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-853617.0Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-853627.0Release of invalid pointer or reference in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.CVE-2026-853638.8Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.CVE-2026-853647.0Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-853657.0Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.CVE-2026-853667.8Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-853677.0Use after free in Windows Cash Drawer Protocol Provider allows an authorized attacker to elevate privileges locally.CVE-2026-853687.8Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
CVE-2026-85357: High severity, CVSS 7.0 | Vulnix