Cyber Resilience

CVE-2026-32160

Race Condition in Microsoft Windows 10 21H2 ≤ 10.0.19044.7184

Published
14 April 2026
Modified
20 April 2026
Patch / advisory
CVSS Score v3.1 7.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0020 10th percentile
Risk Priority 53 floored blend · peak EPSS

Summary

CVE-2026-32160 is a high-severity Race Condition (CWE-362) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 10th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-39 (Process Isolation) and SC-4 (Information in Shared System Resources) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-32160 is a race condition vulnerability (CWE-362) stemming from concurrent execution using a shared resource with improper synchronization in the Windows Push Notifications component. Published on 2026-04-14T18:17:17.953, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) and affects Windows systems.

A local attacker with low privileges can exploit this vulnerability due to its local attack vector (AV:L) and low privilege requirement (PR:L). Exploitation demands high complexity (AC:H) but requires no user interaction (UI:N). Successful attacks enable local privilege escalation, resulting in high impacts across confidentiality, integrity, and availability (C:H/I:H/A:H) with a changed scope (S:C).

Microsoft's Security Update Guide provides details on mitigation and patches for CVE-2026-32160 at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32160.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-33839Same product: Microsoft Windows 10 1809
CVE-2026-32088Same product: Microsoft Windows 10 1809
CVE-2026-27918Same product: Microsoft Windows 10 1809
CVE-2026-20866Same product: Microsoft Windows 10 1809
CVE-2026-21234Same product: Microsoft Windows 10 1809
CVE-2025-64658Same product: Microsoft Windows 10 1809
CVE-2026-42977Same product: Microsoft Windows 10 1809
CVE-2026-20930Same product: Microsoft Windows 10 1809
CVE-2026-32164Same product: Microsoft Windows 10 1809
CVE-2025-59193Same product: Microsoft Windows 10 1809

Affected Assets

microsoft
windows 10 1809
≤ 10.0.17763.8644 · ≤ 10.0.17763.8644
microsoft
windows 10 21h2
≤ 10.0.19044.7184 · ≤ 10.0.19044.7184 · ≤ 10.0.19044.7184
microsoft
windows 10 22h2
≤ 10.0.19045.7184 · ≤ 10.0.19045.7184 · ≤ 10.0.19045.7184
microsoft
windows 11 23h2
≤ 10.0.22631.6936 · ≤ 10.0.22631.6936
microsoft
windows 11 24h2
≤ 10.0.26100.8246 · ≤ 10.0.26100.8246
microsoft
windows 11 25h2
≤ 10.0.26200.8246 · ≤ 10.0.26200.8246
microsoft
windows 11 26h1
≤ 10.0.28000.1836 · ≤ 10.0.28000.1836
microsoft
windows server 2019
≤ 10.0.17763.8644
microsoft
windows server 2022
≤ 10.0.20348.5020
microsoft
windows server 2022 23h2
≤ 10.0.25398.2274
+1 more product configuration(s) — see NVD for full list

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V10.4.2
  • V10.4.5
  • V15.1.3
  • V15.4.1

Mitigating Controls (NIST 800-53 r5) AI

Maintaining separate execution domains for each process structurally eliminates unintended concurrent access to the same shared resources.

Preventing unintended information transfer through shared system resources directly addresses the improper concurrent modification that defines a race condition.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require proper synchronization primitives and concurrency testing that prevent race conditions.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing can detect race conditions, but does not prevent them at design or coding time.

prevents

Secure SDLC mandates concurrency controls and synchronization primitives that directly prevent race conditions.

prevents

Application security requirements can specify thread-safety and locking rules, but do not prescribe implementation details.

prevents

Secure architecture principles require proper synchronization and resource isolation, addressing the root cause of CWE-362.

prevents

Secure coding standards explicitly forbid unsafe concurrent access patterns and mandate atomic operations or locks.

none

Change management reduces introduction of concurrency bugs during updates, yet does not address the weakness itself.

References