CVE-2026-72948: CWE-23: Relative Path Traversal in Microsoft Windows 10 Version 1607

This vulnerability involves a relative path traversal flaw in the Windows DNS service, which can be exploited by an authorized local attacker to elevate their privileges on affected Windows 10 Version 1607 and other specified Windows versions. The flaw allows the attacker to manipulate file paths to access or modify resources outside the intended directory, leading to privilege escalation. The CVSS vector indicates the attack requires local access with low complexity, high privileges, no user interaction, and results in high confidentiality, integrity, and availability impacts. Microsoft has published an official fix for this vulnerability.

An authorized local attacker can exploit this vulnerability to elevate privileges, potentially gaining higher-level access than intended. This can compromise system confidentiality, integrity, and availability on affected Windows versions.

An official fix is available from Microsoft. Users and administrators should apply the security updates provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72948 to remediate this vulnerability.