The vulnerability resides in Windows Management Services and permits a locally authenticated attacker to read sensitive data that should be protected. This local information disclosure can expose configuration details, credentials, or other confidential information. The weakness is identified as CWE‑200, a classic information‐disclosure flaw.

Microsoft Windows 10 versions 1809, 21H2, and 22H2; Microsoft Windows 11 versions 22H3, 23H2, 24H2, and 25H2; Microsoft Windows Server editions 2019, 2022 (including Server Core installations), 2025, and the 23H2 Server Core edition. The CVE lists specific builds for 64‑bit and 32‑bit architectures and also includes ARM64 variants for the 23H2, 24H2, and 25H2 Windows 11 releases.

The CVSS score of 5.5 indicates a medium severity, and the EPSS score is less than 1 %, suggesting a very low likelihood that the exploit is in widespread use. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local privileged user with access to the Windows Management Services API; no external or network‑based trigger is documented.