This vulnerability involves a race condition (CWE-362) in the Function Discovery Service component of Windows 10 Version 1607 (build 10.0.14393.0). Improper synchronization when concurrently accessing shared resources can be exploited by an authorized local attacker to gain elevated privileges. The issue is confirmed by Microsoft and has an official fix released. The CVSS v3.1 score is 7.0, reflecting high impact on confidentiality, integrity, and availability, with attack vector local and requiring low privileges but high attack complexity.

Successful exploitation allows an authorized local attacker to elevate their privileges on the affected system, potentially gaining higher-level access than intended. This can compromise system confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32093 to remediate this vulnerability.