I found this vulnerability during an external penetration test. During the engagement it was possible to exploit the vulnerability to gain remote code execution on a Windows host. I reported the vulnerability to MITRE and the CVE was listed several months later.
NIST link: CVE-2021-37599
Vulnerability description: winscribe.html