When you run MoNotificationUxStub.exe on Windows Server 2025, it will try to load the following non-existing library:

C:\Windows\UUS\amd64\UMPDC.dll

We can place our own, leading to the code execution:

Same as in the previous case, TrustedInstaller rights are required to write to the folder.