An authorized user can trigger a local file‑explorer process to expose sensitive system data that should be protected from unauthorized actors. The vulnerability leverages improper handling of file metadata in Windows Explorer, allowing an attacker who already has rights on the machine to view data they should not have read access to. This can lead to leakage of confidential files, configuration information, or other system details, potentially aiding further compromise.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 22H3, 23H2, 24H2, and 25H2; and Microsoft Windows Server editions 2016 (including Server Core), 2019, 2022, and 2025 (including Server Core). All affected releases are identified by the corresponding CPE strings for x86/x64/arm64 architectures.

The CVSS score of 5.5 indicates moderate severity; the EPSS score of less than 1% confirms a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed widespread exploitation. The attack requires the attacker to have local privileges and to launch Windows Explorer; thus the vector is local with user interaction. Due to the lack of a publicly known exploit or kit, the main risk is the passive leakage of sensitive data rather than active compromise.