An authorized attacker can exploit a flaw in the Windows Remote Procedure Call mechanism to expose sensitive data on a local machine. This weakness allows the attacker to read information that should remain confidential, violating the system’s integrity and confidentiality protections. The vulnerability is classified as CWE-200, indicating improper handling of information disclosure.

Microsoft Windows 10 releases from version 1607 through 22H2, Windows 11 releases from version 22H3 to 26H1, and all Windows Server editions from 2016 through 2025, including Server Core installations and the 23H2 edition, are affected. All these systems contain the vulnerable Remote Procedure Call component that may reveal data to an authorized local user.

Standards rate the flaw at a CVSS score of 5.5, reflecting moderate severity. The EPSS score is not published, and the vulnerability is not currently catalogued by CISA as an actively exploited vulnerability. Attackers would need local administrative or privileged user rights to reach the RPC interface, making the risk local rather than remote. Nonetheless, any user with sufficient privileges can exploit the flaw to gain unauthorized access to sensitive data.