This vulnerability, identified as CWE-922, involves insecure storage of sensitive information in Windows Cryptographic Services on Windows 10 Version 1607 (build 10.0.14393.0). An authorized local attacker can exploit this weakness to elevate privileges on the affected system. The CVSS 3.1 base score is 7.0, indicating high severity, with attack vector local, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. Microsoft has published an official fix to address this issue.

An authorized local attacker can leverage this vulnerability to gain elevated privileges, potentially compromising system confidentiality, integrity, and availability. This could allow the attacker to perform actions beyond their original permissions on the affected Windows 10 Version 1607 system.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-26152 to remediate this vulnerability.