Executive brief
A vulnerability in the Windows SMB Server, which is used for sharing files and printers across a network, could allow an authorized user to crash the service. This would result in a denial of service, preventing other users from accessing shared files or network resources. While the attack requires an account on the network, it can be performed remotely.
Technical details
A race condition (CWE-362) exists in the Windows SMB Server due to improper synchronization when multiple threads access shared resources concurrently. An attacker with low-privileged network access can exploit this flaw by sending specially crafted requests that trigger the synchronization error. Successful exploitation results in a denial of service (DoS) condition on the affected server. The attack has high complexity as it requires winning a race condition, but it can be executed remotely by an authenticated user. Microsoft has released security updates to address this issue across various Windows and Windows Server versions.
Affected products
- Microsoft Windows 10 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 22H3, 23H2, 24H2, 25H2
- Microsoft Windows Server 2008 R2 Service Pack 1 All versions
Timeline
- 2026-01-13: advisory: Initial advisory published by Microsoft and NVD.