CVE-2025-54108
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A race condition due to improper synchronization of a shared resource exists in the Capability Access Management Service (camsvc). This allows an authorized attacker to elevate privileges locally.
Risk Assessment
An authorized local user could exploit the race to gain higher privileges on Windows.
Recommendation
Apply Microsoft security updates for camsvc and limit local accounts with elevated privileges.
Other vulnerabilities in Capability Access Management Service (camsvc)
See all- CVE-2026-20851Medium
An out-of-bounds read vulnerability in Capability Access Management Service (camsvc) allows an unauthorized attacker to disclose information locally.
- CVE-2026-20835Medium
An out-of-bounds read vulnerability in Capability Access Management Service (camsvc) allows an authorized attacker to disclose information locally.
- CVE-2026-20815High
A race condition exists in the Capability Access Management Service (camsvc) due to improper synchronization of shared resources. This allows an authorized attacker to elevate privileges locally.
Original NVD description (English source)
Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an authorized attacker to elevate privileges locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS