CVE-2026-50385 is a Windows Runtime elevation of privilege vulnerability caused by a race condition involving concurrent execution and improper synchronization. Microsoft rates it High severity with a CVSS v3.1 base score of 8.8 and temporal score of 7.7. The vector is local, low complexity, low privileges required, no user interaction, and scope changed, with high confidentiality, integrity, and availability impacts. Microsoft reports no public disclosure and no known exploitation; exploit code maturity is unproven, and exploitation is rated unlikely. The issue affects local execution contexts rather than network-exposed services, but it is still relevant for enterprise systems where untrusted local code or users can run.

Highlights:
- CVSS scores: Base 8.8 - Temporal 7.7
- Exploit status & code maturity: Publicly Disclosed: No; Exploited: No; Exploit Code Maturity: UNPROVEN.
- Impact: Elevation of Privilege; confidentiality, integrity, and availability impacts are all HIGH.
- Exploitation likelihood: Exploitation Unlikely; vector is LOCAL with LOW attack complexity, LOW privileges required, and NO user interaction.
- Severity for enterprise: High technical severity, but enterprise exposure is reduced by the local-only attack vector. Risk is more relevant on systems where users or code can execute locally, rather than on internet-facing services.
- Patch status: available

Affected systems:
- Windows 11 24H2
- Windows 11 25H2
- Windows 11 26H1
- Windows 11 unspecified
- Windows Server 2025