This vulnerability is a TOCTOU race condition in the Windows LUAFV component of Windows 10 Version 1607 (build 10.0.14393.0). It enables an attacker with local access and limited privileges to exploit the timing discrepancy between checking a condition and using the result, leading to privilege escalation. The CVSS v3.1 base score is 7.0, indicating high severity, with attack vector local, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

An authorized local attacker can exploit this TOCTOU race condition to elevate their privileges, potentially gaining higher system rights. This can lead to full system compromise, including unauthorized access to sensitive data and disruption of system availability.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-27929 to remediate this vulnerability.