This vulnerability is a TOCTOU race condition in Windows HTTP.sys on Windows 10 Version 1809 (build 10.0.17763.0). It allows a local attacker with some level of authorization to escalate privileges by exploiting the timing window between checking and using a resource. The CVSS 3.1 vector indicates low attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Microsoft has released an official patch to remediate this vulnerability.

Successful exploitation enables an authorized local attacker to elevate privileges, potentially gaining higher system rights. This could lead to full system compromise, including unauthorized access to sensitive data, modification of system files, or denial of service. The vulnerability affects Windows 10 Version 1809 specifically.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21240 to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.