Improper removal of sensitive information during storage or transfer by the Windows Recovery Environment Agent lets an attacker bypass a built-in security feature. The flaw is classified as sensitive information exposure (CWE-212). If exploited, a user with physical access could potentially cause the system to accept compromised artifacts or configurations that bypass recovery-time checks, thereby gaining unauthorized access or privileges.

Windows operating systems affected include Windows 10 releases from 1607 through 22H2 and Windows 11 releases from 23H2 through 26H1 and 25H2, as well as Windows Server 2016, 2019, 2022, 2025, and the 23H2 edition, covering both standard and Server Core installations.

The CVSS score is 4.6, indicating moderate severity. No EPSS data is published and the vulnerability is not listed in the KEV catalog. Attackers would need physical access to a machine running the affected Windows version to trigger the bypass; therefore, the risk is contingent on the likelihood of physical compromise but the impact of a successful exploit is significant because it undermines recovery-time security controls.