An authorized local attacker can exploit a flaw in Windows File Explorer to expose sensitive information stored on the system. This vulnerability, identified as CWE-200, allows disclosure of data that should remain confidential, potentially compromising user privacy and revealing sensitive system details. Because the issue only affects local access, the threat is limited to scenarios where the attacker already has access to the target machine, yet it still provides a convenient vector for local malicious actors to gather privileged data.

Microsoft Windows 10 releases from version 1607 through 22H2 and Windows 11 editions 23H2, 24H2, 25H2, 22H3, and 26H1 are susceptible, as are all Windows Server releases from 2012 up through 2025, including core installations. These broad OS version ranges mean that many production and client machines could be vulnerable if the applicable security update has not been applied.

The CVSS score of 5.5 places this vulnerability in the moderate severity range, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. With no EPSS score available and the requirement for local, authorized access, the risk is lower than that of remote exploits. Nevertheless, any local attacker—such as a privileged user or someone with physical access—can leverage this flaw, making timely patching the most effective defensive measure.