On Microsoft Windows, the SMB server drivers (srv.sys and srv2.sys) do not check the destination of a NTFS mount point when manually handling a reparse operation leading to being able to locally open an arbitrary device via an SMB client which can result in privilege escalation.
18c5e8b69488f509de251342dd3e47d18e57b85a83a80396d794f1f67e9b08c0