CVE-2026-20853CWE-362

CVE-2026-20853

High · published January 13, 2026

CVSS v3.1
7.4
EPSS
0%
Percentile
23.0
In the wild
Unconfirmed
What it is

⚡ A crafty race condition in Windows WalletService might just let an unauthorized user elevate their privileges like a sly cat sneaking into a warm lap! Think of this as a busy restaurant kitchen where two chefs chase the last ingredient at the same time, leading to a mix-up that could let any customer grab the chef's special dish without paying. This vulnerability allows attackers to exploit improper synchronization between processes, just like those chefs bumping into each other and causing chaos. If exploited, this could allow an attacker to gain higher privileges on the system, potentially accessing sensitive data or taking control of your device. It’s like giving someone the master key to your house — they could access everything, change locks, or even move in without your permission!

Put simply

Think of this as a busy restaurant kitchen where two chefs chase the last ingredient at the same time, leading to a mix-up that could let any customer grab the chef's special dish without paying. This vulnerability allows attackers to exploit improper synchronization between processes, just like those chefs bumping into each other and causing chaos. This vulnerability is a race condition in Windows WalletService where inadequate synchronization allows unauthorized access, leading to privilege escalation. An attacker can exploit this flaw by executing multiple processes simultaneously to breach the security model.

What to do

If exploited, this could allow an attacker to gain higher privileges on the system, potentially accessing sensitive data or taking control of your device. It’s like giving someone the master key to your house — they could access everything, change locks, or even move in without your permission! To protect yourself, ensure your Windows system is updated to the latest version where this issue is patched. Regularly check for and apply security updates to minimize risk. It’s also wise to monitor access logs for unusual activity to spot any unauthorized attempts. You've got this! Stay proactive and keep your system secure! 🛡️

The record
Technical detail
CVSS v3.1
7.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00313 · 23.0th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2026-01-13T23:16Z
Affected products (9)
ProductVersionsFixed in
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1607< 10.0.14393.878310.0.14393.8783
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_1809< 10.0.17763.827610.0.17763.8276
microsoft/windows_10_21h2< 10.0.19044.680910.0.19044.6809
microsoft/windows_10_22h2< 10.0.19045.680910.0.19045.6809
microsoft/windows_11_23h2< 10.0.22631.649110.0.22631.6491
microsoft/windows_11_24h2< 10.0.26100.762310.0.26100.7623
microsoft/windows_11_25h2< 10.0.26200.762310.0.26200.7623
References (1)
EPSS history
Timeline
  • 13 JAN 17:56Z
    Windows WalletService Elevation of Privilege Vulnerability
    cvelistv5