Security advisory2026-10-13Software component projectSecurity advisory

Software component issue could cause actions to run with inconsistent state

A public security advisory describes this issue. Review the linked source for the technical details and remediation guidance.

What happened

  • Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Phone Service allows an authorized attacker to elevate privileges locally.Security Advisory CVE-2026-85357
  • Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Phone Service allows an authorized attacker to elevate privileges locally.Advisory description (CVE-2026-85357)

Contributing factors stated by the source

  • Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Phone Service allows an authorized attacker to elevate privileges locally.

The failure pattern

Duplicate action after an ambiguous resultA request times out, the caller assumes it failed and retries, and the money moves (or the order ships) twice.How to prevent it Automation acts on stale state or authorizationA background job or automation acts on a plan, permission or record that changed after it was read.How to prevent it
Watch the pattern: Duplicate action after an ambiguous result

Related standards

CollectSEA's mapping through this incident's failure pattern; not an official determination by the standards bodies.

Building something similar?

Describe your design and see every precedent that applies, with safeguards you can hand to your coding agent.

Analyze your design

Incidents with the same pattern