CWE-362: Race Condition vulnerabilities

CVE-2026-96932 is a race condition vulnerability in the Windows Embedded Mode Service on Microsoft Windows 10 Version 1607 and related builds. It allows an authorized local attacker to elevate privileges by exploiting improper synchronization during concurrent execution of shared resources. The vulnerability has a high severity rating with a CVSS score of 7.0. Microsoft has issued official fixes for affected versions.

CVE-2026-96919 is a use-after-free vulnerability in the Windows Broadcast DVR User Service affecting multiple builds of Windows 10 Version 1809 and later. An authorized local attacker can exploit this flaw to elevate privileges. The vulnerability has a high severity rating and has been officially fixed by Microsoft in specific Windows 10 builds.

CVE-2026-70250 is a high-severity use-after-free vulnerability in the Windows DHCP Client component affecting multiple versions of Microsoft Windows Server 2012 and related Windows versions. This flaw allows an unauthorized attacker on an adjacent network to execute arbitrary code without user interaction. The vulnerability has been officially fixed in specific updates for the affected versions.

CVE-2026-88174 is a race condition vulnerability in Windows Deployment Services on Microsoft Windows 10 Version 1607 and related versions. It allows an unauthorized attacker to execute code remotely over a network due to improper synchronization of shared resources. The vulnerability has a high severity with a CVSS score of 8.1. Official patches have been released to address this issue.

CVE-2026-85941 is a race condition vulnerability in the Windows Installer component of Microsoft Windows 10 Version 1607 and related builds. It allows a locally authorized attacker to elevate privileges due to improper synchronization when accessing shared resources. The vulnerability has been assigned a high severity score of 7.0 and affects multiple Windows 10 builds prior to specific fixed versions.

CVE-2026-85912 is a race condition vulnerability in the Windows Clipboard User Service affecting multiple Windows 10 Version 1607 builds. This flaw allows an authorized local attacker to elevate privileges by exploiting improper synchronization during concurrent execution of shared resources. The vulnerability has been assigned a high severity score and has been officially fixed in several Windows 10 updates.

CVE-2026-83899 is a race condition vulnerability in the Windows Installer component of Microsoft Windows 10 Version 1607 and related builds. It allows an authorized local attacker to elevate privileges due to improper privilege management. The vulnerability affects multiple Windows 10 builds prior to specific fixed versions. Microsoft has released official fixes for the affected versions.

CVE-2026-83841 is a race condition vulnerability in the Windows Win32K component of Microsoft Windows 10 Version 1809 and related builds. It allows an authorized local attacker to elevate privileges by exploiting improper synchronization during concurrent execution using a shared resource. The vulnerability has a high severity rating and affects multiple Windows 10 versions prior to specific fixed releases. An official fix is available from Microsoft.

CVE-2026-81971 is a race condition vulnerability in the Windows NTFS component of Microsoft Windows 10 Version 1607 and related builds. It allows an authorized local attacker to elevate privileges due to improper synchronization when accessing shared resources. The vulnerability has been assigned a high severity score of 7.0 CVSS v3.1 and affects multiple Windows 10 versions prior to specific fixed releases.

CVE-2026-69736 is a race condition vulnerability in the Windows Credential Manager affecting multiple versions of Microsoft Windows 10, including version 1607. This flaw allows an authorized local attacker to elevate privileges due to improper synchronization when accessing shared resources. The vulnerability has a high severity rating and has been officially fixed in various Windows 10 builds.

CVE-2026-69856 is a use-after-free vulnerability in Windows Storage on Microsoft Windows 10 Version 1809 and related builds. It allows an authorized local attacker to elevate privileges. The vulnerability has been assigned a high severity score and has been officially fixed in multiple Windows 10 versions.

CVE-2026-69931 is a race condition vulnerability in the Windows Storage component of Microsoft Windows 10 Version 1809 and related builds. It allows an authorized local attacker to elevate privileges due to improper synchronization when concurrently accessing shared resources. The vulnerability has a high severity rating and affects multiple Windows 10 versions prior to specific fixed releases. An official fix is available from Microsoft.

CVE-2026-96215 is a race condition vulnerability in Windows Autopilot on Microsoft Windows 11 Version 24H2. It allows an authorized local attacker to elevate privileges by exploiting improper synchronization during concurrent execution using a shared resource. The vulnerability affects specific builds of Windows 11 Version 24H2 prior to fixed versions. A patch is available and has been officially released by Microsoft.

CVE-2026-70183 is a race condition vulnerability in Microsoft ASP.NET Core 10.0 that allows an authorized attacker to elevate privileges over a network. The flaw arises from improper synchronization during concurrent execution using a shared resource. This vulnerability affects multiple versions of ASP.NET Core prior to their respective fixed releases. A high-severity CVSS score of 7.5 has been assigned. Official patches are available to remediate this issue.

CVE-2026-88146 is a race condition vulnerability in the Windows Background Intelligent Transfer Service (BITS) on Windows 10 Version 1809 and related builds. It allows an authorized local attacker to elevate privileges due to improper synchronization when accessing shared resources. The vulnerability has a high severity rating and has been officially fixed by Microsoft in multiple Windows 10 builds.

CVE-2026-88107 is a use-after-free vulnerability in the Windows Cloud Files Mini Filter Driver affecting multiple versions of Microsoft Windows 10, including Version 1809. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating and has been officially fixed in several Windows 10 builds.

CVE-2026-87710 is a race condition vulnerability in the Microsoft Local Security Authority Server (lsasrv) component of Windows 10 Version 1607 and other specified versions. This flaw allows an authorized local attacker to elevate privileges due to improper access control. The vulnerability has a high severity score and has been officially fixed in multiple Windows 10 builds.

CVE-2026-85904 is a race condition vulnerability in the Windows Device Association Service affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized local attacker to elevate privileges due to improper synchronization when concurrently accessing shared resources. The vulnerability has a high severity rating and has been officially fixed in several Windows 10 updates.

CVE-2026-85329 is a race condition vulnerability in Microsoft Account on Windows 10 Version 1607 and related builds. It allows an authorized local attacker to elevate privileges due to improper synchronization when accessing shared resources. The flaw affects multiple Windows 10 versions prior to specific fixed releases. An official fix is available from Microsoft.

CVE-2026-88160 is a race condition vulnerability in the Microsoft Windows Search Component affecting Windows 10 Version 1607 and related builds. It allows an authorized local attacker to elevate privileges due to improper synchronization when accessing shared resources. The issue has been assigned a high severity score and has been officially fixed in multiple Windows 10 builds.