CVE-2026-42978

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

Affected products

Windows, Windows Push Notifications Apps

Microsoft Windows 10 1809

< 10.0.17763.8880

Microsoft Windows 10 21h2

< 10.0.19044.7417

Microsoft Windows 10 22h2

< 10.0.19045.7417

Microsoft Windows 11 23h2

< 10.0.22631.7219

Microsoft Windows 11 24h2

< 10.0.26100.8655

Microsoft Windows 11 25h2

< 10.0.26200.8655

CVSS 3.1

7.8 HIGH

EPSS

0.2% (16th percentile)

Weakness

CWE-416, CWE-362

NVD status

Analyzed

Published

2026-06-09