CVE-2026-20853

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.4 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

C

oncurrent execution using shared resource with improper synchronization ('race condition') in Windows WalletService allows an unauthorized attacker to elevate privileges locally.

References

Link	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20853	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:microsoft:windows_10_1607:::::::x64:*
	cpe:2.3:o:microsoft:windows_10_1607:::::::x86:*
	cpe:2.3:o:microsoft:windows_10_1809:::::::x64:*
	cpe:2.3:o:microsoft:windows_10_1809:::::::x86:*
	cpe:2.3:o:microsoft:windows_10_21h2::::::::
	cpe:2.3:o:microsoft:windows_10_22h2::::::::
	cpe:2.3:o:microsoft:windows_11_23h2::::::::
	cpe:2.3:o:microsoft:windows_11_24h2::::::::
	cpe:2.3:o:microsoft:windows_11_25h2::::::::

History

15 Jan 2026, 13:28

Type	Values Removed	Values Added
First Time		Microsoft windows 10 21h2 Microsoft windows 10 22h2 Microsoft windows 10 1809 Microsoft windows 11 25h2 Microsoft windows 11 23h2 Microsoft windows 11 24h2 Microsoft Microsoft windows 10 1607
CPE		cpe:2.3:o:microsoft:windows_10_1809:::::::x86:* cpe:2.3:o:microsoft:windows_11_25h2:::::::: cpe:2.3:o:microsoft:windows_10_1809:::::::x64:* cpe:2.3:o:microsoft:windows_10_21h2:::::::: cpe:2.3:o:microsoft:windows_10_1607:::::::x86:* cpe:2.3:o:microsoft:windows_10_22h2:::::::: cpe:2.3:o:microsoft:windows_11_23h2:::::::: cpe:2.3:o:microsoft:windows_10_1607:::::::x64:* cpe:2.3:o:microsoft:windows_11_24h2::::::::
References	~~() https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20853 -~~	() https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20853 - Vendor Advisory

13 Jan 2026, 18:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-01-13 18:16

Updated : 2026-01-15 13:28

NVD link : CVE-2026-20853

Mitre link : CVE-2026-20853

CVE.ORG link : CVE-2026-20853

JSON object : View

Products Affected

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

{"id": "CVE-2026-20853", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.4}]}, "published": "2026-01-13T18:16:13.990", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20853", "tags": ["Vendor Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "Concurrent execution using shared resource with improper synchronization ('race condition') in Windows WalletService allows an unauthorized attacker to elevate privileges locally."}], "lastModified": "2026-01-15T13:28:14.337", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "9A956D23-259E-450B-8406-FEB2BBED1F39", "versionEndExcluding": "10.0.14393.8783"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*", "vulnerable": true, "matchCriteriaId": "41D387B9-5E9D-47CB-B044-D7D10FFFB458", "versionEndExcluding": "10.0.14393.8783"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*", "vulnerable": true, "matchCriteriaId": "DD4CBDAB-7626-4048-8474-B1BD9C1F3255", "versionEndExcluding": "10.0.17763.8276"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*", "vulnerable": true, "matchCriteriaId": "A6D4C631-2CC0-407C-9ACA-7C151006598C", "versionEndExcluding": "10.0.17763.8276"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1895E186-5B2E-43CC-AF1F-B5C95419D8C5", "versionEndExcluding": "10.0.19044.6809"}, {"criteria": "cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B7CB5184-1BA1-4D71-8AE3-CF4C6B63A469", "versionEndExcluding": "10.0.19045.6809"}, {"criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8D675DAA-4DCE-4727-BE5F-C954BBD252C4", "versionEndExcluding": "10.0.22631.6491"}, {"criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D249551B-1433-4E5E-A587-40F782E91E09", "versionEndExcluding": "10.0.26100.7623"}, {"criteria": "cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22082D4E-E68F-4E48-98FB-42DFDEE2E2A8", "versionEndExcluding": "10.0.26200.7623"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}