An improper access control in the Windows Camera Frame Server Monitor allows an attacker who already has authorized local access to read information that should be restricted, potentially exposing camera-related data or configuration details. This flaw is based on CWE‑284, where insufficient permissions enable sensitive data exposure, leading to a confidentiality breach in the affected environment.

Microsoft Windows 11 Version 24H2, Windows 11 Version 25H2, Windows Server 2025, and the Server Core installation of Windows Server 2025 are all vulnerable when running the Camera Frame Server Monitor component. The issue applies to the specific versions listed and does not affect earlier releases or versions not enumerated.

With a CVSS score of 7.1 and an EPSS score of less than 1 %, the vulnerability poses a moderate to high severity but has a very low likelihood of exploitation at this time; it is not currently listed in the CISA KEV catalog. The attack vector is local – an adversary must already possess authorized user rights or sufficient privileges on the system to interact with the Camera Frame Server Monitor, after which the compromised access control can be used to disclose sensitive information.