The vulnerability arises from improper handling of sensitive metadata inside Windows File Explorer, permitting an authorized local user to read information that should remain confidential. This flaw falls under the information disclosure weakness identified as CWE‑200 and does not enable remote code execution, privilege escalation, or denial of service. The knowledge of the data exposed is limited to the local context and requires authenticated access to the affected system.

Microsoft Windows operating systems—including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 22H3, 23H2, 24H2, and 25H2; and Windows Server editions from 2016 through 2025—are impacted. The flaw exists across both x86/x64 and arm64 architectures where applicable.

The CVSS score of 5.5 classifies the issue as moderate severity, and the EPSS score of less than 1 % indicates a very low probability of exploitation. Attackers must be authorized users possessing sufficient local privilege; no remote exploitation path is available. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog.