The vulnerability in Windows File Explorer exposes sensitive local information to an authorized user. An attacker who can authenticate to the system can exploit a flaw that discloses metadata or other details that should remain confidential. This information exposure is classed as CWE‑200, compromising confidentiality without affecting integrity or availability.

The flaw affects multiple Microsoft Windows editions. It is present in Windows 10 releases from version 1607 through 22H2, Windows 11 versions 22H3, 23H2, 24H2, 25H2, and all Windows Server editions from 2016, 2019, 2022, up to 2025, including both full and core installations.

With a CVSS score of 5.5 the weakness is moderate. EPSS is below 1 %, indicating a low but non‑zero likelihood of exploitation. The problem is local: an attacker must already have a legitimate user session on the machine. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widely published exploits exist. Nonetheless, any system that handles highly sensitive data should address it promptly.