This vulnerability, identified as CWE-36 (Absolute Path Traversal), exists in the Windows Shell component of Microsoft Windows 10 Version 1607 (build 10.0.14393.0). It enables an unauthorized attacker to exploit the system through physical access to perform spoofing attacks by manipulating file paths. The CVSS 3.1 base score is 4.6, reflecting a medium severity with attack vector requiring physical access, low attack complexity, no privileges or user interaction needed, and high confidentiality impact. Microsoft has released an official fix to address this issue.

An attacker with physical access to a system running the affected Windows 10 Version 1607 can exploit the absolute path traversal vulnerability to perform spoofing attacks, potentially misleading users or software by manipulating file paths. The confidentiality of information may be compromised, but integrity and availability are not impacted according to the CVSS vector. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Windows 10 Version 1607 (build 10.0.14393.0) as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20834 to remediate this vulnerability.