CVE-2026-32164
Published: 14 April 2026
Summary
CVE-2026-32164 is a high-severity Race Condition (CWE-362) vulnerability in Microsoft Windows 10 21H2. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 15.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-25 (Reference Monitor) and SC-4 (Information in Shared System Resources).
Deeper analysis
CVE-2026-32164 is a race condition vulnerability (CWE-362), stemming from concurrent execution using a shared resource with improper synchronization in the Windows User Interface Core component. Published on April 14, 2026, it carries a CVSS v3.1 base score of 7.8 (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating high severity due to its potential for significant confidentiality, integrity, and availability impacts within a changed scope.
A local attacker with low privileges (PR:L) can exploit this vulnerability by triggering the race condition, requiring high attack complexity (AC:H) but no user interaction (UI:N). Successful exploitation enables privilege escalation, granting the attacker high-level access to the system and potentially compromising the entire machine.
For mitigation details, refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32164.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-22556
Vulnerability details
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to elevate privileges locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Race condition in Windows UI Core directly enables local privilege escalation via software vulnerability exploitation (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents unauthorized information transfer via shared system resources, addressing the core race condition with improper synchronization in Windows User Interface Core.
Implements a reference monitor for complete mediation of resource accesses, countering race-based privilege escalation attempts.
Enforces least privilege on processes to limit the potential impact and scope of successful local privilege escalation from the race condition.