A type‑confusion flaw in the Windows COM subsystem permits an authorized user to expose sensitive configuration data or other information that should remain private. The vulnerability is identified as CWE‑843 and can lead to the disclosure of data that the attacker is not normally permitted to view.

Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 22H3, 23H2, 24H2, 25H2, and 26H1; Windows Server 2019 and 2022, Windows Server 2025, and the corresponding Server Core installations.

The CVSS score of 5.5 indicates moderate severity. Based on the description, the attack requires local authorized access; an attacker must have permission to instantiate the COM component. No EPSS information or KEV listing means the exploit is not known to be actively used in the wild, but local privileged users still face a risk of data leakage.