This vulnerability involves a race condition (CWE-362) in the Windows User Interface Core component of Windows 10 Version 1607 (build 10.0.14393.0). Due to improper synchronization when concurrently accessing shared resources, an authorized local attacker can elevate their privileges. The CVSS 3.1 vector indicates the attack requires local access with high attack complexity and low privileges but no user interaction, and successful exploitation can result in complete confidentiality, integrity, and availability compromise. Microsoft has published an official fix for this vulnerability.

Exploitation of this race condition vulnerability allows an authorized local attacker to elevate their privileges on the affected system. This can lead to full system compromise including unauthorized access to sensitive data, modification of system settings, and disruption of system availability. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators of Windows 10 Version 1607 should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27911 to remediate this vulnerability.