An execution path in the Windows kernel can cause an error message to reveal sensitive data. The flaw arises when the kernel generates an error that leaks information, enabling an attacker with local privileges to gain access to details that should remain confidential. The vulnerability is classified under CWE-209, which describes improper error handling that exposes sensitive data. No additional outcome such as privilege escalation or denial of service is indicated by the available information.

Microsoft Windows 11 versions 23H2, 24H2, 25H2, 22H3 and Microsoft Windows Server 2022 and 2025, including the 23H2 (Server Core) edition. These include both arm64 and x64 builds for desktop and server configurations.

The CVSS score of 5.5 places the vulnerability in the medium severity range, while the EPSS indicator of less than 1% suggests that exploitation is currently unlikely. The flaw can be exploited only by a user who is already authorized on the target machine, meaning that attackers require local access or existing user privileges to trigger the kernel error. The fact that it is not listed in the CISA KEV catalog further indicates that there is no known public exploitation or widespread active use of this vulnerability.