Windows exposes sensitive information when processing shell links, allowing an attacker to spoof information over a network. This vulnerability permits disclosure of confidential data and could be used to impersonate legitimate files or directories. The weakness is an information‑disclosure flaw that compromises confidentiality and could manipulate user trust.

Affected systems include Microsoft Windows 10 starting from version 1607 up through 22H2, Microsoft Windows 11 from 23H2 to 26H1, and Windows Server editions ranging from 2012 to 2025, including Server Core installations. All listed operating system versions are impacted.

The CVSS score of 5.3 indicates a medium severity, while the EPSS score below 1% suggests a low exploitation probability. The vulnerability is not on the CISA KEV list. Based on the description, the likely attack vector is a network-bound spoofing attempt where an attacker crafts malicious shell link data to deceive a victim. Successfully hijacked links could reveal sensitive information to the attacker. The impact is constrained to environments that process shell links without additional safeguards.