This vulnerability, identified as CWE-416 (Use After Free), exists in the Windows DHCP Client of Windows 10 Version 1607 (build 10.0.14393.0). It allows an attacker without privileges or user interaction to execute arbitrary code locally by exploiting the use-after-free condition. The vulnerability is rated high severity with a CVSS 3.1 score of 8.4, reflecting high impact on confidentiality, integrity, and availability. Microsoft has published an official fix to remediate this issue.

Successful exploitation of this vulnerability could allow an unauthorized attacker to execute arbitrary code locally on the affected Windows 10 Version 1607 system. This could lead to full system compromise, including complete control over the affected machine, impacting confidentiality, integrity, and availability.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Windows 10 Version 1607 as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54128. No additional mitigation actions are indicated by the vendor advisory.