An exposure of sensitive system information in the Windows kernel permits an attacker who has local system access to read privileged data, leading to confidentiality compromise. The flaw is defined as CWE-497, an improper restriction of operations performed by privileged code, enabling local disclosure of sensitive information.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and all Windows Server editions from 2012 through 2025 are affected.

With a CVSS score of 5.5 the vulnerability is moderate, and the EPSS score is unavailable, indicating no current data on exploitation likelihood. The flaw requires local access and is not listed in the CISA KEV catalog, so the threat is limited to attackers who can already run code on the target machine. No public exploit is documented, but because the information disclosed is highly sensitive, applying the vendor’s update is recommended.