Local privilege escalation via ineffective SMB write lock

Privilege escalation in Mozilla Firefox before 112, Firefox ESR before 102.10, and Thunderbird before 102.10 allows local users to gain SYSTEM access. The Maintenance Service reads an attacker-selected MAR archive twice, and an SMB server can replace it after signature verification because the requested write lock is ineffective. Exploitation requires local Windows access and an installed Maintenance Service; the demonstrated payload runs as LocalSystem.