The vulnerability is a race condition (CWE‑362) in the Windows TCP/IP stack that allows an attacker to trigger unauthorized code execution on a target machine. An attacker who can send crafted network traffic over an adjacent network can exploit the improper synchronization of a shared resource in the TCP/IP protocol implementation, leading to arbitrary code execution with system privileges.

Microsoft Windows 10 builds 1607, 1809, 21H2, 22H2 and Windows 11 editions 24H2, 25H2, 26H1, as well as Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025, including server core installations, are impacted according to the CNA vendor and product list.

The CVSS score of 8.8 marks this as a high‑severity flaw, but the EPSS score is listed as less than 1 percent, indicating a very low likelihood of exploitation in the wild. It is not currently included in the CISA KEV catalog. Based on the description, the likely attack vector is over an adjacent network; an attacker must be able to inject traffic that exercises the race condition, which does not require user interaction on the target. Exploitation would provide full control of the machine through the Windows networking stack.