The vulnerability is an information disclosure in the Windows Remote Procedure Call (RPC) subsystem. An unauthenticated local attacker can recover sensitive data that is not intended for public visibility, classifying the flaw as CWE‑200. The leaked information could assist a local threat actor in gathering context for further attacks or in pivoting to higher privileges. No impact on system availability or integrity is described, and the flaw does not allow remote execution or denial of service.

Microsoft Windows 10 from version 1607 through 22H2, Windows 11 from 23H2 through 25H2, and Windows Server from 2008 R2 SP1 through 2025 – including both standard and Server Core installations – are listed as affected in the CNA advisory.

The CVSS base score is 6.2, indicating moderate severity, while the EPSS score is less than 1 %, suggesting a low probability of exploitation. The flaw is not present in the CISA KEV catalog. Attack requires local access; the most likely attack vector is that a user or process with local privileges exploits the RPC interface. Exploitation simply reveals data – there is no evidence of privilege escalation or remote code execution. Early patching of the supported Windows releases mitigates this exposure. The overall risk remains moderate but is constrained to machines where an attacker can already obtain local or user-level access.