This vulnerability involves a race condition (CWE-362) in the Windows Push Notifications component of Windows 10 Version 21H2 (build 10.0.19044.0). Due to improper synchronization when accessing shared resources concurrently, an authorized local attacker can exploit this flaw to elevate privileges. The issue has been assigned CVE-2026-26172 and carries a CVSS 3.1 base score of 7.8, indicating high severity. Microsoft has published an official fix to remediate the vulnerability.

Successful exploitation allows a local authorized attacker to elevate their privileges on the affected Windows 10 system, potentially gaining higher-level access and control. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector (C:H/I:H/A:H). There are no reports of active exploitation in the wild.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26172 to remediate this vulnerability. No additional mitigation steps are indicated by the vendor.