TL;DR: Things are written to assume that files opened exclusively cannot change. Windows enforces that write protection on files in the filesystem driver. If you open a file over a network from a non-Windows filesystem, that assumption may not be valid.

This allows an attacker to abuse paging to have the system validate a correctly-signed file, then swap out the contents.