A race condition exists in the Windows TCP/IP stack that allows an unauthenticated attacker to trigger code execution over the network. The flaw arises from concurrent access to a shared resource without proper synchronization, consistent with CWE‑362. When successfully exploited, the attacker can run arbitrary code on the affected system, potentially gaining full administrative control and compromising confidentiality, integrity, and availability.

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), and Microsoft Windows Server releases including 2012, 2012 R2, 2016, 2019, 2022, 2025, 23H2 (both full and Server Core installations). All listed OS releases rely on the native TCP/IP stack that contains the vulnerability; specific build identifiers are not provided here.

The vulnerability carries a CVSS score of 8.1, indicating high severity, and the EPSS score is not available, though the attack is possible by simply sending malicious traffic over a network. The exploit requires network reachability to the target; no local user interaction is needed. Because the flaw can be leveraged remotely, it poses a serious risk, especially to systems exposed to the internet or untrusted networks. The vulnerability is not yet listed in the CISA KEV catalog, which suggests that widespread exploitation has not yet been observed, but the high impact warrants urgent attention.