CVE-2026-69364: CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in Microsoft Windows 10 Version 1607

This vulnerability (CVE-2026-69364) involves a race condition (CWE-362) in the Windows Print Spooler components that allows an authorized attacker to elevate privileges remotely. The flaw arises from improper synchronization when multiple threads access shared resources concurrently, potentially leading to privilege escalation. The affected products include multiple builds of Windows 10 starting from version 1607 and later builds up to specific patched versions. Microsoft has released official fixes for these affected versions.

An authorized attacker can exploit this race condition vulnerability over a network to elevate their privileges, potentially gaining higher-level access than intended. This can lead to full system compromise, including confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:H/I:H/A:H). There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided by Microsoft for the affected Windows 10 versions as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69364. No additional mitigations are specified beyond applying the official patches.