This vulnerability (CVE-2026-32212) affects Windows 10 Version 1607 (build 10.0.14393.0) and is caused by improper link resolution before file access in the upnp.dll module, classified under CWE-59 (Improper Link Resolution Before File Access). An authorized attacker with local privileges can leverage this flaw to disclose sensitive information. The CVSS 3.1 base score is 5.5 (medium severity) with attack vector local, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. Microsoft has released an official patch to remediate this vulnerability.

The vulnerability allows an authorized local attacker to disclose sensitive information due to improper handling of symbolic links before accessing files in the Universal Plug and Play component. There is no impact on system integrity or availability. The confidentiality impact is rated high, meaning sensitive data could be exposed locally by an attacker with limited privileges.

An official fix is available from Microsoft to remediate this vulnerability. Users and administrators should apply the provided security update as soon as possible. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32212 for detailed patch information and deployment guidance.