A race condition in the Windows Server Network driver arises when multiple processes access a shared resource without proper synchronization, allowing an attacker to exploit the timing flaw to execute arbitrary code. This flaw is a classic concurrency vulnerability (CWE‑362) that can lead to full system compromise, giving the attacker control over data, processes, and potentially the entire operating system. The vulnerability is likely to be leveraged by crafting malicious network traffic that triggers the erroneous execution path.

The flaw affects multiple Microsoft Windows desktop and server releases, including Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 24H2, 25H2 and 26H1; and Windows Server from 2012 through 2025, covering both standard and Server Core installations. All listed releases are susceptible unless patched according to Microsoft’s guidance.

The CVSS score of 9.8 denotes critical severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation seen in the wild, though this does not diminish the risk posed by the flaw. The vulnerability is not in the CISA Known Exploited Vulnerabilities catalogue, but the attack vector is inferred to be over non‑trusted networks due to the remote code execution capability. An attacker who can manipulate network packets to the vulnerable driver can trigger the race condition and gain code execution privileges, potentially bypassing authentication and escalating privileges on the host.