This vulnerability (CVE-2026-20824) involves a protection mechanism failure in the Windows Remote Assistance feature of Microsoft Windows 10 Version 1607 (build 10.0.14393.0). It enables an unauthorized attacker with local access to bypass a security feature, potentially compromising confidentiality. The CVSS v3.1 base score is 5.5, reflecting local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, and no integrity or availability impact. Microsoft has published an official fix to address this issue.

An unauthorized local attacker can bypass a security feature in Windows Remote Assistance, leading to a high confidentiality impact. There is no impact on integrity or availability. The vulnerability requires local access and user interaction, limiting remote exploitation potential.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20824 to remediate this vulnerability.