The vulnerability is a race condition in the Windows SMB Server that lets an authorized attacker exploit improper synchronization on shared resources to raise their privileges when communicating over the network. This flaw could let an attacker gain higher local system privileges, thereby compromising confidentiality, integrity, and availability of the host.

Affected products include multiple Microsoft Windows and Windows Server releases such as Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 22H3; and Windows Server 2012 through 2025 across both full and core installations.

The CVSS score of 7.5 indicates a moderate to high severity, while the very low EPSS (<1%) suggests a low current exploitation probability. The flaw is not listed in KEV, so no widespread active exploits are documented. An authorized attacker with legitimate access to the SMB service can trigger the race condition over the network, potentially escalating local privileges. The risk increases if SMB is exposed to untrusted networks or lacks adequate access controls.