The flaw stems from an improper synchronization of a shared resource in the Windows SMB implementation, creating a race condition that an attacker can exploit after authenticating to SMB. By manipulating the timing of SMB requests, the attacker causes the service to assume an elevated privilege level that matches the SMB service process. The vulnerability does not provide arbitrary code execution but allows the attacker to gain higher privileges on the host. The included CWE identifiers indicate both a race condition (CWE‑362) and a use‑after‑free scenario (CWE‑416).

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 24H2, 25H2, 26H1; and Microsoft Windows Server releases 2012 through 2025, including both full installations and Server Core deployments are affected. All impacted versions of the SMB protocol are exposed.

The CVSS score of 7.5 classifies this as a high‑severity vulnerability. The EPSS score of less than 1 % indicates a low probability of widespread exploitation at present. It is not listed in the CISA KEV catalog, so no publicly documented exploits are known. The likely attack path requires the attacker to be authenticated to SMB, then send a crafted sequence of requests that triggers the race condition and elevation. The use‑after‑free weakness (CWE‑416) may allow additional memory corruption if the attack succeeds, but the primary risk is privilege escalation. The vulnerability can be mitigated only by applying the vendor patch, as no other technical exploits are currently available.