This vulnerability involves a race condition (CWE-362) in Windows Shell on Windows 10 Version 1809 (build 10.0.17763.0). Improper synchronization of concurrent execution using shared resources allows a user with local access and limited privileges to elevate their privileges. The CVSS 3.1 vector indicates the attack requires local access with low complexity and no user interaction, resulting in high impact on confidentiality, integrity, and availability. Microsoft has published an official fix to remediate this vulnerability.

An authorized local attacker can exploit this race condition to gain elevated privileges on the affected system. This could lead to full system compromise, including unauthorized access to sensitive data and the ability to modify system configurations or disrupt system availability. No known active exploits have been reported.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27918 to remediate this vulnerability. No additional mitigation steps are indicated by the vendor.