This vulnerability, tracked as CVE-2026-25187 and classified under CWE-59 (Improper Link Resolution Before File Access), affects Windows 10 Version 1607 (build 10.0.14393.0). It arises from improper handling of symbolic links or similar link types in the Winlogon process, which can be abused by an authorized local user to gain elevated privileges. The CVSS 3.1 vector indicates local attack vector, low attack complexity, required privileges, no user interaction, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

An authorized local attacker can exploit this vulnerability to elevate their privileges on the affected Windows 10 system, potentially gaining higher-level access than intended. This can lead to full system compromise, including unauthorized access to sensitive data and disruption of system operations. The vulnerability affects confidentiality, integrity, and availability with high severity.

Microsoft has released an official security update that addresses this vulnerability. It is strongly recommended to apply the provided patch from the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-25187 to remediate this issue. No additional mitigations are specified by the vendor.