This vulnerability (CVE-2026-25190) is classified as CWE-426: Untrusted Search Path. It affects Windows 10 Version 1607 (build 10.0.14393.0) and involves the Windows Graphics Device Interface (GDI) component. The issue arises because the system improperly handles the search path for loading resources, allowing an attacker with local access to execute arbitrary code by placing malicious files in a location that is searched before the legitimate ones. The CVSS 3.1 vector indicates local attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. Microsoft has published this vulnerability and confirmed that a patch is available.

Successful exploitation allows an unauthorized local attacker to execute arbitrary code with the privileges of the affected user, potentially leading to full compromise of the system's confidentiality, integrity, and availability. Because the attack requires local access and user interaction, remote exploitation is not feasible. No known exploits are currently reported in the wild.

A patch is available from Microsoft to remediate this vulnerability. It is recommended to apply the official update for Windows 10 Version 1607 (build 10.0.14393.0) as soon as possible to mitigate the risk. Since this is a local vulnerability requiring user interaction, limiting local access and educating users about suspicious activity can also reduce risk until patching is complete.