This vulnerability (CWE-312) involves the cleartext storage of sensitive information within Windows Hello on Windows 10 Version 1607 (build 10.0.14393.0). An attacker with local authorized access can exploit this flaw to tamper with the stored data. The vulnerability has a CVSS 3.1 base score of 5.5, reflecting a medium severity with local attack vector, low attack complexity, and requiring low privileges without user interaction. Microsoft has released an official fix to remediate this issue.

The vulnerability allows an authorized local attacker to tamper with sensitive information stored in cleartext by Windows Hello. While confidentiality is not directly impacted, the integrity of sensitive data can be compromised, potentially affecting authentication mechanisms relying on Windows Hello. There is no indication of remote exploitation or denial of service impact.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-61928 to remediate this vulnerability.