Windows Kernel Denial of Service Vulnerability

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send the user a malicious input file and convince the user to open said input file.

According to the CVSS metric, user interaction is required (UI:R) and privileges required is Low (PR:L). What does that mean for this vulnerability?
An authenticated attacker could create a malicious extension and then wait for an authenticated user to create a new Visual Studio project that uses that extension. The result is that the attacker could gain the privileges of the user.

Security updates
10.0.17763.6414 — https://support.microsoft.com/help/5044277
10.0.20348.2762 — https://support.microsoft.com/help/5044281
10.0.22000.3260 — https://support.microsoft.com/help/5044280
10.0.19044.5011 — https://support.microsoft.com/help/5044273
10.0.22621.4317 — https://support.microsoft.com/help/5044285
10.0.25398.1189 — https://support.microsoft.com/help/5044288
10.0.26100.2033 — https://support.microsoft.com/help/5044284
10.0.10240.20796 — https://support.microsoft.com/help/5044286
10.0.14393.7428 — https://support.microsoft.com/help/5044293
6.0.6003.22918 — https://support.microsoft.com/help/5044320
6.0.6003.22918 — https://support.microsoft.com/help/5044306
6.1.7601.27366 — https://support.microsoft.com/help/5044356
6.1.7601.27366 — https://support.microsoft.com/help/5044321
6.2.9200.25118 — https://support.microsoft.com/help/5044342
6.3.9600.22221 — https://support.microsoft.com/help/5044343