CVE-2026-32163

CWE-362 — Race Condition CWE-416 — Use After Free3 documents3 sources

Severity

7.8HIGH

EPSS

No EPSS data

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Microsoft Windows 10 Version 1809 Microsoft Windows 10 Version 21h2 Microsoft Windows 10 Version 22h2 +10 more

Timeline

PublishedApr 14

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to elevate privileges locally.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 1.1 | Impact: 6.0

Affected Packages13 packages

▶CVEListV5microsoft/windows_server_2019_(server_core_installation)10.0.17763.0 — 10.0.17763.8644

▶CVEListV5microsoft/windows_server_2025_(server_core_installation)10.0.26100.0 — 10.0.26100.32690

▶CVEListV5microsoft/windows_server_201910.0.17763.0 — 10.0.17763.8644

▶CVEListV5microsoft/windows_server_202210.0.20348.0 — 10.0.20348.5020

▶CVEListV5microsoft/windows_server_202510.0.26100.0 — 10.0.26100.32690

🔴Vulnerability Details

VulDB

Microsoft Windows up to Server 2025 User Interface Core race condition↗2026-04-14

▶

CVEList

Windows User Interface Core Elevation of Privilege Vulnerability↗2026-04-14

▶