This vulnerability is a TOCTOU race condition in the Windows LUAFV component on Windows 10 Version 1607 (build 10.0.14393.0). It allows a local attacker with some level of authorization to exploit the timing discrepancy between checking a condition and using a resource, resulting in privilege escalation. The CVSS 3.1 vector indicates local attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

An authorized local attacker can exploit this TOCTOU race condition to elevate privileges, potentially gaining higher system rights than intended. This could lead to full system compromise depending on the privileges escalated. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. It is recommended to apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27929 to remediate this vulnerability.