The flaw originates from an uninitialized resource within Windows File Explorer. An authorized user can trigger the defect to read data that should not be exposed, exposing sensitive information. This weakness is classified as CWE‑908, indicating a failure to properly initialize or manage a resource before use, which directly leads to information disclosure.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2 as well as Windows 11 versions 24H2, 25H2, and 26H1. All supported Windows Server releases from 2016 through 2025, including Server Core editions, are also impacted. Any user operating one of these systems who runs File Explorer with sufficient privileges is at risk.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% signals a very low probability of exploitation in the wild, and the flaw is not listed in CISA’s KEV catalog. Because the attack requires local, authenticated interaction with Windows File Explorer, the threat is limited to users who already possess privileges sufficient to launch the application; attackers with only remote access or lower privileges cannot exploit the vulnerability.