An insertion of sensitive information into a Windows kernel log file allows an authorized local attacker to read that information, exposing confidential data. The weakness is logging of sensitive data, classified as CWE‑532. The vulnerability does not provide remote code execution or service disruption, but it enables an attacker who has local access to obtain data that should remain confidential.

Microsoft Windows 10 versions 1809, 21H2, 22H2; Microsoft Windows 11 versions 22H3, 23H2, 24H2, 25H2, 26H1; Microsoft Windows Server 2019 (including Server Core), Windows Server 2022 (including Server Core 23H2 Edition), and Windows Server 2025 (including Server Core). All listed editions are impacted.

The CVSS score of 5.5 indicates a medium severity. Exploitation requires local authorized access; a remote attacker cannot exploit this weakness. The vulnerability is not listed in the CISA KEV catalog and no EPSS score is available. Therefore, the risk is moderate, primarily affecting users with local privileges who can read kernel log files.