This vulnerability, identified as CWE-426 (Untrusted Search Path), exists in Microsoft XML on Windows 10 Version 1607 (build 10.0.14393.0). It allows an attacker with physical access to exploit the untrusted search path to bypass security features. The CVSS 3.1 vector indicates the attack requires physical access (AV:P), high attack complexity (AC:H), no privileges (PR:N), and no user interaction (UI:N). The impact includes high confidentiality, integrity, and availability impacts. Microsoft has published an official fix for this vulnerability.

An attacker with physical access to a system running the affected Windows 10 Version 1607 can bypass security features due to the untrusted search path in Microsoft XML. This can lead to full compromise of confidentiality, integrity, and availability on the affected system. However, the attack complexity is high and requires physical presence, limiting remote exploitation.

An official patch is available from Microsoft to remediate this vulnerability. Users and administrators should apply the update provided in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57097 to fully mitigate the risk.