The vulnerability is a race condition in the Windows SMB Server caused by improper synchronization of a shared resource. An attacker who can send concurrent SMB traffic to the target may trigger the race and gain elevated privileges on the system, potentially allowing full system compromise. The weakness is identified as CWE‑362, a concurrency error.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 22H3, 23H2, 24H2, 25H2; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2022 23H2, 2025, with both full and Server Core installations affected.

The CVSS score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests a low current exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is network‑based SMB traffic; an attacker would need some level of authentication or access to the SMB service and would exploit the race through carefully timed concurrent requests. The impact is privilege escalation for the target system, potentially extending to full compromise if followed by further exploitation.