This vulnerability, identified as CWE-59 (Improper Link Resolution Before File Access), affects Windows 10 Version 1607 (build 10.0.14393.0). It occurs in the Winlogon process where symbolic links or similar link types are improperly resolved before accessing files, enabling a local attacker with some authorization to escalate privileges. The CVSS 3.1 base score is 7.8, reflecting high impact on confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability, and no known exploits are reported in the wild.

Successful exploitation allows an authorized local attacker to elevate their privileges, potentially gaining higher system rights than intended. This can lead to full system compromise, including unauthorized access to sensitive data and system control.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Windows 10 Version 1607 as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42989. No additional mitigation steps are indicated beyond applying the official patch.