This is a heap-based buffer overflow in Windows Shell with a CVSS of 7.8 and local access requirement. That severity is genuine—Shell runs at high integrity and processes untrusted input from nearly every desktop interaction, making post-compromise privilege escalation to SYSTEM integrity levels highly valuable in any attack chain. However, the EPSS score of 0.00246 should not be read as a clean bill of health. It reflects the current absence of active exploitation tooling, not necessarily the absence of risk.
The specific target—Windows 10 version 1607, released in 2016 and end-of-support since 2021—changes the risk calculus. When a vulnerability in orphaned code surfaces with a CVE, the EPSS model treats it as low-priority because the analytical attention market has moved on. That same analytical abandonment is what makes this dangerous: security scanners may not surface it against supported inventories, defenders have no vendor patch to apply, and any attacker who now has this roadmap is operating in a space where nobody's watching.
The practical priority: treat this as a vulnerability with blast radius, not trigger probability. Identify whether Windows 10 1607 persists anywhere in your environment—particularly in embedded systems, air-gapped deployments, or legacy operational technology. If it does, this CVE is a named privilege escalation path with no remediation coming, and you should model the lateral movement potential from it accordingly. The absence of active exploitation tooling does not mean the absence of capable adversaries who now have a documented path to SYSTEM integrity in environments where detection coverage may have lapsed.