This vulnerability is a TOCTOU race condition (CWE-367) in the Windows Network File System component of Windows 10 Version 1607 (build 10.0.14393.0). It allows an attacker with some level of authorization to exploit the timing window between checking and using a resource, potentially leading to privilege escalation over a network. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity. Microsoft has published an official fix for this vulnerability.

An authorized attacker can exploit this TOCTOU race condition remotely over the network to elevate their privileges on the affected Windows 10 Version 1607 system. This could lead to full system compromise with high impact on confidentiality, integrity, and availability of the system.

An official patch is available from Microsoft to remediate this vulnerability. Users and administrators should apply the update provided in the Microsoft security advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-56648 to mitigate the risk. No additional mitigations are specified by the vendor.