This vulnerability involves incorrect permission assignment for a critical resource within the Windows Accessibility Infrastructure component (ATBroker.exe) in Windows 10 Version 1607 (build 10.0.14393.0). An authorized local attacker can exploit this flaw to elevate their privileges on the affected system. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, and no user interaction required. Microsoft has published an official fix to address this issue.

Successful exploitation allows an authorized local attacker to elevate privileges, potentially gaining higher-level access and control over the affected system. This could lead to full system compromise depending on the privileges gained.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Windows 10 Version 1607 to remediate this vulnerability. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-24291 for detailed update instructions.