A race condition arises from concurrent execution that uses a shared resource without proper synchronization. This flaw can be exploited by an attacker to run arbitrary code on the target system, compromising confidentiality, integrity and potentially allowing full system takeover. The vulnerability is classified as CWE‑362.

The flaw affects Microsoft Windows 10 versions 1607 and 1809, as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025, including both standard and Server Core installations, when Windows Deployment Services is present.

The CVSS score of 8.1 indicates a high severity of the vulnerability, and no EPSS data was reported to indicate a current exploitation probability. The description identifies an unauthorized network attacker being able to execute code, so the attack vector is network‑based and does not require local privileges. An attacker who can reach the Windows Deployment Services service can trigger the race condition, inject malicious code, and gain remote code execution capabilities on the affected server.