This vulnerability (CVE-2026-7791) is a TOCTOU race condition in Amazon WorkSpaces for Windows affecting versions before 2.6.2034.0. The issue lies in the Skylight Workspace Config Service's log rotation mechanism, which improperly handles file system permissions during the check and use phases. This flaw allows a local authenticated user without administrative privileges to bypass these protections and place arbitrary files in arbitrary locations on the file system. Successful exploitation can result in local privilege escalation to SYSTEM level. The CVSS 3.1 base score is 7.8, indicating high severity. No known exploits are reported in the wild. The vendor has not provided an official remediation level or confirmed patch status in the available data. The advisory URL from AWS is provided for further updates.

A local non-administrative authenticated user can exploit this TOCTOU race condition to bypass file system permission protections and place arbitrary files in arbitrary locations. This can lead to local privilege escalation to SYSTEM level, granting the attacker full control over the affected system. No known exploits have been observed in the wild to date.

Patch status is not yet confirmed — check the vendor advisory at https://aws.amazon.com/security/security-bulletins/2026-025-aws/ for current remediation guidance. Until an official fix is available, users should follow any vendor recommendations and consider restricting local user access where possible to reduce risk.