Windows SMB Remote Code Execution Vulnerability

How could an attacker exploit the vulnerability?
For vulnerability to be exploited, a user would need to access a malicious SMB server to retrieve some data as part of an OS API call.

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
This vulnerability requires that a user with an affected version of Windows access a malicious server. An attacker would have to host a specially crafted server share or website. An attacker would have no way to force users to visit this specially crafted server share or website, but would have to convince them to visit the server share or website, typically by way of an enticement in an email or chat message.

Security updates
10.0.17763.2803 — https://support.microsoft.com/help/5012647
10.0.18363.2212 — https://support.microsoft.com/help/5012591
10.0.19043.1645 — https://support.microsoft.com/help/5012599
10.0.20348.643 — https://support.microsoft.com/help/5012604
10.0.22000.613 — https://support.microsoft.com/help/5012592
10.0.10240.19265 — https://support.microsoft.com/help/5012653
10.0.14393.5066 — https://support.microsoft.com/help/5012596
6.1.7601.25924 — https://support.microsoft.com/help/5012626
6.1.7601.25924 — https://support.microsoft.com/help/5012649
6.3.9600.20337 — https://support.microsoft.com/help/5012670
6.3.9600.20337 — https://support.microsoft.com/help/5012639
6.0.6003.21446 — https://support.microsoft.com/help/5012658
6.0.6003.21446 — https://support.microsoft.com/help/5012632
6.2.9200.23679 — https://support.microsoft.com/help/5012650
6.2.9200.23679 — https://support.microsoft.com/help/5012666