This vulnerability (CVE-2026-20931) involves external control of file name or path in the Windows Telephony Service on Windows 10 Version 1607 (build 10.0.14393.0). An authorized attacker on an adjacent network can exploit this to elevate privileges. The CVSS 3.1 vector indicates the attack requires adjacent network access, low attack complexity, and low privileges, with no user interaction needed. The impact includes high confidentiality, integrity, and availability consequences. Microsoft has published an official fix for this vulnerability.

Exploitation of this vulnerability allows an authorized attacker on an adjacent network to elevate their privileges, potentially gaining higher-level access than intended. This can lead to full compromise of confidentiality, integrity, and availability of the affected system.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-20931 to remediate this vulnerability.