CVE WatchSep 8, 2026

CVE-2026-58848

In multiple functions of alloc.c, there is a possible unauthorized read/write access due to a race condition. This could lead to local escal

CVSS

7.0

High

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Sep 8, 2026 · Last modified: Sep 8, 2026 · CWE-362

EPSS · 30d

Not enough EPSS history yet.

Technical description

In multiple functions of alloc.c, there is a possible unauthorized read/write access due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-778947.0 HIG

—

———Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.6h CVE-2026-730057.0 HIG

—

———Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.8h CVE-2026-705826.4 MED

—

———Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.8h CVE-2026-700915.9 MED

—

———Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an unauthorized attacker to deny service over a network.7h CVE-2026-698278.1 HIG

—

———Concurrent execution using shared resource with improper synchronization ('race condition') in DNS Server allows an unauthorized attacker to execute code over a network.8h CVE-2026-697997.8 HIG

—

———Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hello allows an authorized attacker to elevate privileges locally.8h