This vulnerability (CVE-2026-24291) affects Windows 10 Version 1607 (build 10.0.14393.0) and is caused by improper permission settings on a critical resource within the Windows Accessibility Infrastructure component ATBroker.exe. An authorized local attacker can exploit this to elevate privileges, potentially gaining higher system rights than intended. The CVSS 3.1 vector indicates local attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. The vulnerability is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource). A patch is available from Microsoft to remediate this issue.

Successful exploitation allows an authorized local attacker to elevate privileges on the affected Windows 10 Version 1607 system. This can lead to full system compromise, including unauthorized access to sensitive data and system control. The vulnerability impacts confidentiality, integrity, and availability with high severity as per the CVSS score of 7.8.

An official patch is available from Microsoft to fix this vulnerability. It is recommended to apply the provided security update to affected Windows 10 Version 1607 systems promptly. Since this is a local privilege escalation vulnerability, restricting local access to trusted users until patched can reduce risk. No additional mitigations are specified.