The Desktop Window Manager component in multiple Microsoft Windows and Server products exposes sensitive information to an unauthorized actor, but only when the attacker already has local access. The flaw allows a local attacker, such as malware running with user‑level privileges, to read data that should have been protected by system boundaries. Because the vulnerability does not require network access, the impact is confined to confidentiality loss on the affected machine rather than system‑wide compromise.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 22H3; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and the 23H2 edition. Both x86, x64, and arm64 architectures are impacted depending on the specific release.

The CVSS score of 5.5 indicates a moderate risk severity. An EPSS of 4% suggests a low but non‑zero probability of exploitation in the wild, which is corroborated by the vendor’s KEV listing. Attackers need local execution privileges to exploit the flaw, so the risk is limited to machines with compromised local accounts. The vulnerability is readily exploitable through existing remote code execution malware that gains a foothold on the target system, enabling the attacker to dump or exfiltrate sensitive information.