CVE-2026-32091
Published: 14 April 2026
Summary
CVE-2026-32091 is a high-severity Race Condition (CWE-362) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 8.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 5.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-4 (Information in Shared System Resources) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-32091 is a race condition vulnerability stemming from concurrent execution using a shared resource with improper synchronization, classified under CWE-362 and CWE-416. It affects the Microsoft Brokering File System and was published on 2026-04-14 with a CVSS v3.1 base score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
An unauthorized local attacker can exploit this vulnerability due to its low attack complexity, lack of privilege requirements, and absence of user interaction. Successful exploitation enables local privilege escalation, resulting in high impacts to confidentiality, integrity, and availability within the unchanged security scope.
The Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32091 provides details on patches and mitigation guidance.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22530
Vulnerability details
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local race condition/use-after-free in Microsoft Brokering File System directly enables local privilege escalation without authentication or user interaction, mapping to T1068 Exploitation for Privilege Escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents unauthorized and unintended information transfer via shared file system resources exploited by the race condition in Microsoft Brokering File System.
Remediates the specific race condition flaw through timely identification, reporting, and correction including vendor patches from MSRC.
Limits the impact of local privilege escalation resulting from the race condition by restricting processes to the least privileges necessary.