CVE-2026-50297: CWE-284: Improper Access Control in Microsoft Windows 10 Version 1607

This vulnerability, identified as CVE-2026-50297 and classified under CWE-284 (Improper Access Control), affects the Win32K subsystem in Microsoft Windows 10 Version 1607 (build 10.0.14393.0). It enables an authorized local attacker to escalate privileges, potentially gaining higher-level access than intended. The CVSS v3.1 base score is 7.0, indicating high severity, with attack vector local, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

An authorized local attacker can exploit this vulnerability to elevate their privileges on the affected Windows 10 system, potentially gaining administrative rights. This could allow the attacker to execute arbitrary code with elevated permissions, compromise system confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Microsoft has released an official fix for CVE-2026-50297. It is recommended to apply the security update provided by Microsoft as soon as possible to remediate this vulnerability. Refer to the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50297 for detailed patching instructions.