A race condition in the Windows SMB Server allows an authorized attacker to trigger a denial of service over the network. The flaw arises from improper synchronization when multiple requests use a shared resource, causing the SMB service to hang or crash. The result is a loss of file sharing and printer services for all clients that rely on the affected host.

Microsoft Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 22H3), Microsoft Windows Server 2008 R2 SP1 (including Server Core), Windows Server 2008 Service Pack 2 (including Server Core), Microsoft Windows Server 2012 and 2012 R2 (including Server Core), Microsoft Windows Server 2016 and 2019 (including Server Core), Microsoft Windows Server 2022 (including 23H2 Edition and Server Core), and Microsoft Windows Server 2025 (including Server Core).

The CVSS score of 5.3 indicates a moderate severity; however, the EPSS score of less than 1% suggests the likelihood of exploitation is very low. The vulnerability appears in the CISA KEV catalog as not listed, further supporting a lower operational risk. Based on the description, it is inferred that the attacker must have authorized access to the SMB service on the target machine, typically via remote privileged or legitimate credentials, and that the attack can be initiated over the network by sending a specially crafted SMB request that exploits the race condition.