Home

Description

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows WalletService allows an unauthorized attacker to elevate privileges locally.

PUBLISHED Reserved 2025-12-03 | Published 2026-01-13 | Updated 2026-02-22 | Assigner microsoft




HIGH: 7.4CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Problem types

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Product status

10.0.14393.0 (custom) before 10.0.14393.8783
affected

10.0.17763.0 (custom) before 10.0.17763.8276
affected

10.0.19044.0 (custom) before 10.0.19044.6809
affected

10.0.19045.0 (custom) before 10.0.19045.6809
affected

10.0.22631.0 (custom) before 10.0.22631.6491
affected

10.0.22631.0 (custom) before 10.0.22631.6491
affected

10.0.26100.0 (custom) before 10.0.26100.7623
affected

10.0.26200.0 (custom) before 10.0.26200.7623
affected

References

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20853 (Windows WalletService Elevation of Privilege Vulnerability) vendor-advisory patch

cve.org (CVE-2026-20853)

nvd.nist.gov (CVE-2026-20853)

Download JSON