SB2026071501 - Multiple vulnerabilities in Microsoft Windows App Store

Description

This security bulletin contains information about 4 vulnerabilities.

1) Race condition (CVE-ID: CVE-2026-42900)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to a race condition in Microsoft Windows App Store. A remote attacker can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

2) Race condition (CVE-ID: CVE-2026-50356)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in Microsoft Windows App Store. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

3) Race condition (CVE-ID: CVE-2026-49784)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to a race condition in Microsoft Windows App Store. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.

4) Use of uninitialized resource (CVE-ID: CVE-2026-49165)

CWE-ID: CWE-908 - Use of Uninitialized Resource

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to bypass certain security restrictions.

The vulnerability exists due to usage of uninitialized resources in Microsoft Windows App Store. A local user can pass specially crafted data to the application, trigger uninitialized usage of resources and gain access to sensitive information on the system.

Remediation

Install update from vendor's website.

References

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42900
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50356
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49784
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-49165