CVE-2026-48578 is an improper access control vulnerability (CWE-284) affecting Windows Secure Boot in Microsoft Windows 10 Version 1607 (build 10.0.14393.0). It enables an authorized attacker with local access and high privileges to elevate their privileges further, potentially compromising system confidentiality and integrity. The vulnerability has a CVSS 3.1 base score of 7.9, reflecting high impact on confidentiality and integrity without requiring user interaction. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

An authorized local attacker with high privileges can exploit this vulnerability to elevate their privileges further, potentially gaining greater control over the affected system. The impact includes high confidentiality and integrity compromise but does not affect availability. There are no known exploits in the wild currently.

Microsoft has released an official fix for this vulnerability. It is recommended to apply the security update provided by Microsoft for Windows 10 Version 1607 (build 10.0.14393.0) as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48578. No additional mitigation actions are required beyond applying the official patch.