This vulnerability, identified as CVE-2026-50325, involves improper access control in the Windows Win32K subsystem on Windows 10 Version 1607 (build 10.0.14393.0). It enables an authorized local attacker with limited privileges to elevate their privileges, potentially gaining higher system rights. The CVSS 3.1 base score is 7.0, indicating high severity, with attack vector local, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. Microsoft has published an official fix to remediate this vulnerability.

An authorized local attacker can exploit this vulnerability to elevate their privileges on the affected Windows 10 Version 1607 system. This could lead to full system compromise, including unauthorized access to sensitive information, modification of system settings, and disruption of system availability.

Microsoft has released an official fix for this vulnerability. It is recommended to apply the security update provided by Microsoft as detailed in their advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50325. No additional mitigation steps are indicated beyond applying the official patch.