The reported vulnerability is a race condition between check and use (time‑of‑check time‑of‑use) in the Windows Network File System. When a client performs specific NFS operations the system performs a status check before the actual use of a resource, but the state can change in the interim, allowing an attacker to cause a privilege escalation. The flaw falls under CWE‑367 for race conditions and CWE‑416 for use‑after‑free abuses. If triggered, an attacker with network access to a machine that has the Windows NFS Server component enabled can elevate from a local account or a restricted user to higher privileges on that host. This potentially compromises availability, confidentiality, and integrity of the affected system.

This flaw affects Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 24H2, 25H2, 26H1), and Windows Server 2012 through 2025, including Server Core installations. All these releases include the Windows Network File System service that, if enabled, provides a pathway for the attacker to exploit the race condition.

The CVSS score of 7.5 indicates a high level of severity in terms of potential impact. The EPSS score of less than 1% reflects a very low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is over the network via an authorized NFS client that can issue carefully crafted requests to the server. Successful exploitation would allow the attacker to gain higher privileges on the affected host.