A race condition (CWE‑362) in the Windows SMB server allows an authorized attacker to hijack a concurrent operation on a shared SMB resource; as a result the attacker can elevate privileges over the network, potentially gaining full control of the affected system.

Affected systems include a wide range of Microsoft Windows client and server releases: Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 22H3, 23H2, 24H2, and 25H2; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, 2022 (23H2 edition), 2025, and their associated server‑core installations.

The CVSS score of 7.5 indicates a moderately high severity, while the EPSS score is less than 1 %, suggesting a very low probability of exploitation in the wild; the vulnerability is not listed in the CISA KEV catalog. The attack requires network‑level access to the SMB service and the ability to authenticate as an authorized user, after which the race condition can be triggered to elevate privileges.