A race condition vulnerability in the Windows kernel allows a locally authenticated attacker to elevate privileges on affected systems.

This flaw involves a TOCTOU race condition within the NtQueryInformationToken function, which can be exploited by an authenticated local attacker to gain elevated privileges.

Successful exploitation of this vulnerability grants an attacker elevated system access, which could lead to full system compromise, unauthorized data access, and the bypass of security restrictions. With a CVSS score of 7.8, this vulnerability is categorized as High, reflecting the significant risk posed to the integrity and confidentiality of the host operating system.

Immediate Action: Apply the relevant security updates provided in the Microsoft update guide to all affected Windows installations immediately.

Proactive Monitoring: Monitor system logs for suspicious process creation or unexpected administrative activity originating from low-privileged user accounts.

Compensating Controls: Ensure that the principle of least privilege is strictly enforced, limiting the ability of standard users to execute arbitrary code or interact with sensitive system functions.

Public Exploit Available: No

Given the potential for local privilege escalation, organizations must prioritize the deployment of the vendor-provided patches. Administrators should verify that all endpoints are updated to the specified non-vulnerable build versions to eliminate the race condition and secure the system against potential local attacks.