This vulnerability (CVE-2026-25165) is a null pointer dereference in the Windows Performance Counters component of Microsoft Windows 10 Version 1607 (build 10.0.14393.0). It enables an attacker with local authorized access to elevate their privileges on the affected system. The CVSS 3.1 base score is 7.8, indicating high severity, with attack vector local, low attack complexity, and no user interaction required. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

An authorized local attacker can exploit this vulnerability to gain elevated privileges, potentially allowing full control over the affected system. The impact includes complete confidentiality, integrity, and availability compromise as indicated by the CVSS metrics (C:H/I:H/A:H). There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Windows 10 Version 1607 (build 10.0.14393.0) as soon as possible to remediate this vulnerability. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25165 for update details and installation instructions.