This vulnerability (CVE-2026-25185) affects Windows 10 Version 1607 (build 10.0.14393.0) and is classified as CWE-200 (Exposure of Sensitive Information). It arises from Windows Shell Link Processing, enabling an unauthorized attacker to expose sensitive information and perform network spoofing. The CVSS 3.1 base score is 5.3 (medium severity), with an attack vector of network, low attack complexity, no privileges or user interaction required, and limited confidentiality impact. Microsoft has published an official fix for this vulnerability.

An attacker can exploit this vulnerability remotely over a network to expose sensitive information without requiring privileges or user interaction. The impact is limited to confidentiality loss; integrity and availability are not affected. This could facilitate spoofing attacks but does not directly allow code execution or system compromise.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25185 to remediate this vulnerability.