CVE-2026-85357

HighCVSS 7.0/10Last modified Oct 28, 2026

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Phone Service allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362CWE-416

Affected software

VendorProductVersions
MicrosoftWindows 11 version 23H2>= 10.0.22631.0, < 10.0.22631.7652
MicrosoftWindows 11 Version 23H2>= 10.0.22631.0, < 10.0.22631.7652
MicrosoftWindows 11 Version 24H2>= 10.0.26100.0, < 10.0.26100.9711
MicrosoftWindows 11 Version 25H2>= 10.0.26200.0, < 10.0.26200.9711
MicrosoftWindows 11 version 26H1>= 10.0.28000.0, < 10.0.28000.3231
MicrosoftWindows 11 Version 26H2>= 10.0.26300.0, < 10.0.26300.9711
MicrosoftWindows Server 2022>= 10.0.20348.0, < 10.0.20348.5761

References

Timeline

Published
Oct 13, 2026
Last modified
Oct 28, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-853587.8Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-853597.8Improper control of generation of code ('code injection') in Windows Performance Monitor allows an authorized attacker to elevate privilegesCVE-2026-85363.1Insufficient validation of untrusted input in ReadingMode in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who had CVE-2026-853607.0Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.CVE-2026-853617.0Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-853627.0Release of invalid pointer or reference in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.CVE-2026-853638.8Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.CVE-2026-853647.0Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-853657.0Heap-based buffer overflow in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.CVE-2026-853667.8Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.CVE-2026-853677.0Use after free in Windows Cash Drawer Protocol Provider allows an authorized attacker to elevate privileges locally.CVE-2026-853687.8Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
CVE-2026-85357: High severity, CVSS 7.0 | Vulnix