The vulnerability stems from inserting sensitive data into a kernel log file, enabling an attacker who already has local system access to read those logs and expose confidential information. The flaw is a local information disclosure identified as CWE‑532. The attacker can gain access to sensitive data without needing remote access or privilege escalation beyond the local user’s existing rights.

Microsoft Windows desktop releases from Windows 10 Version 1607 through Windows 11 Version 24H2, as well as Windows Server 2012 R2 up through Windows Server 2025, are affected. Each listed edition and architecture version listed by Microsoft – Win10 1607, 1809, 21H2, 22H2; Win11 22H3, 23H2, 24H2; and the corresponding Server editions, including Server‑Core variants – is impacted.

The CVSS v3.1 score of 5.5 indicates moderate severity, while the EPSS score of less than 1 % suggests a very low likelihood of exploitation at this time. The vulnerability has not been added to the CISA KEV catalog. To exploit the flaw an adversary must already have authenticated local access or succeed in another local compromise; the attack vector is inferred to be local. Once the attacker obtains a user session, they can read the kernel‑level log file that contains the sensitive data, resulting in confidentiality loss for the affected system.