CVE-2026-32163

What it actually does

This vulnerability is a local elevation-of-privilege flaw caused by improper synchronization of a shared resource in Windows User Interface Core. A low-privileged, authenticated attacker who can execute code locally may be able to win a race condition and cause Windows UI-related components to operate on inconsistent or stale state, potentially resulting in code execution or actions at a higher privilege level. The CVSS vector indicates local access is required, exploitation complexity is high, user interaction is not required, and successful exploitation can affect confidentiality, integrity, and availability with a scope change.

Why it matters to the business

If exploited, a user or malware that already has limited access to a Windows workstation or server could gain elevated privileges, allowing broader system control, credential theft, security-tool tampering, persistence, or lateral movement. This is most concerning as a post-compromise privilege-escalation step when paired with phishing, stolen credentials, remote code execution, or malware already running on an endpoint. The vulnerability is not listed in CISA KEV, has no known ransomware association, and has a low, flat EPSS score, so immediate mass exploitation appears unlikely; however, affected Windows client and server versions are broadly deployed, making timely patching important across enterprise fleets.

How an attack unfolds

An attacker first obtains local, low-privileged code execution on an affected Windows system, such as through malware, a compromised user session, or another vulnerability. The attacker then runs a specially crafted local program that repeatedly triggers the vulnerable Windows User Interface Core behavior and attempts to manipulate timing between concurrent operations on a shared resource. If the race is won, the vulnerable component may perform privileged operations using corrupted, inconsistent, or attacker-influenced state. The attacker can then use the elevated context to perform actions that were previously blocked, such as modifying protected files, dumping credentials, disabling defenses, installing persistence, or moving laterally. Because exploitation requires precise timing and local execution, it is more likely to be used by targeted attackers or malware chains than as a standalone internet-facing exploit.

How to fix it

Apply the Microsoft security update that addresses this vulnerability for all affected Windows versions, including Windows 10 1809, 21H2, and 22H2; Windows 11 23H2, 24H2, 25H2, and 26H1; Windows Server 2019; Windows Server 2022; Windows Server 2022 23H2; and Windows Server 2025. Because no exact fixed build numbers were provided, use Microsoft Update, Windows Update for Business, WSUS, Microsoft Configuration Manager, or the Microsoft Update Catalog to deploy the applicable cumulative security update released on or after the vendor advisory date. Prioritize endpoints where untrusted users can log in, shared workstations, VDI, jump hosts, terminal servers, developer workstations, and servers that allow interactive logon. If immediate patching is not possible, reduce exposure by limiting local logon rights, removing unnecessary administrator-equivalent privileges, enforcing application control, blocking untrusted executables, enabling credential protection features, and monitoring for suspicious local privilege-escalation behavior.

How to confirm the fix worked

Confirm that affected systems have installed the relevant Microsoft cumulative security update for this vulnerability or a later superseding update. Validate through centralized patch-management reporting, Windows Update compliance status, vulnerability scanners, and direct host checks such as installed hotfix or build inventory. Re-scan representative Windows 10, Windows 11, and Windows Server assets after patch deployment to ensure the finding is closed. Where possible, compare OS build and cumulative update levels against Microsoft’s official security update guidance for the advisory date. For high-risk systems, confirm that non-administrative users cannot write to protected locations, modify services, disable endpoint security, or perform other privileged actions after patching.

Typical attack path

1. Gain authenticated local access to an affected Windows workstation or server.
2. Execute a local exploit program under a low-privileged user context.
3. Repeatedly trigger the vulnerable Windows User Interface Core code path to attempt to win the race condition.
4. Cause the privileged component to act on attacker-influenced or inconsistent shared-resource state.
5. Obtain elevated privileges or execute code in a higher-privileged context.
6. Use elevated access to disable defenses, collect credentials, install persistence, access sensitive data, or support lateral movement.

How to detect it

There are no public, vulnerability-specific indicators in the provided data, and race-condition privilege-escalation exploits often leave limited direct evidence. Hunt for post-exploitation behavior rather than a single signature. Relevant log sources include Windows Security logs, Sysmon, Microsoft Defender for Endpoint, EDR process telemetry, PowerShell logs, service-control logs, scheduled-task logs, and file-integrity events. Look for a standard-user process unexpectedly spawning elevated processes, creating or modifying services, changing scheduled tasks, writing to protected directories, disabling security tools, dumping credentials, or modifying local administrator group membership. Correlate suspicious privilege changes with recent execution of unknown binaries from user-writable paths such as Downloads, Temp, AppData, or public directories. On servers and shared systems, review interactive logons followed by privilege-sensitive actions. Because no exploit maturity or KEV activity is reported and EPSS is low and flat, detection should be risk-based and focused on endpoints that show other compromise signals.

• Windows Event ID 4672 followed by privileged activity from an account that is normally non-administrative
• Windows Event ID 4688 process creation from %TEMP%
• Windows Event ID 4688 process creation from %APPDATA%
• Windows Event ID 4688 process creation from %LOCALAPPDATA%\Temp
• Windows Event ID 7045 service installed by a non-administrative or recently compromised account
• Windows Event ID 4697 service installed on the system
• Windows Event ID 4698 scheduled task created after suspicious local process execution
• Windows Event ID 4732 member added to local Administrators group
• Windows Event ID 4720 local user account created
• Windows Event ID 1102 audit log was cleared
• wevtutil cl Security
• sc.exe create
• schtasks.exe /Create
• net localgroup administrators
• powershell.exe Add-LocalGroupMember
• reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
• vssadmin.exe delete shadows
• bcdedit.exe /set {default} recoveryenabled No
• Set-MpPreference -DisableRealtimeMonitoring

What your security team should do

• Patch affected Windows endpoints and servers with the applicable Microsoft cumulative security update or a later superseding update.
• Prioritize multi-user systems, exposed workstations, VDI, jump hosts, terminal servers, and systems used by administrators or developers.
• Review endpoint telemetry for signs of local privilege escalation, especially suspicious child processes, service creation, token manipulation, or defense tampering from standard-user sessions.
• Restrict local logon rights and remove unnecessary local administrator membership across Windows fleets.
• Enforce application control or allowlisting to reduce the chance that untrusted local exploit binaries can execute.
• Ensure EDR, Microsoft Defender, credential protection, tamper protection, and audit logging are enabled on affected systems.
• Treat this vulnerability as a post-compromise escalation risk and investigate it alongside phishing, malware, credential theft, and remote-access intrusion activity.
• Track Microsoft’s advisory for updated affected-build or fixed-build information because exact fixed versions were not provided in the input.