This vulnerability resides in Windows File Explorer and allows an authorized local attacker to disclose sensitive information to an unauthorized actor. The flaw is identified as CWE‑200 and is limited to revealing locally accessible data; it does not provide execution of code or compromise of system integrity.

Affected systems are Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2, Windows 11 versions 24H2, 25H2 and 26H1, and Windows Server 2016, 2019, 2022 and 2025—including both full installations and Server Core builds—explicitly listed by Microsoft as vulnerable.

The CVSS score of 5.5 indicates a moderate severity, while the EPSS score of less than 1 % suggests a very low exploitation probability in the wild. The vulnerability is not listed in the CISA KEV catalogue. The attack vector is local; therefore only users with local access to the affected machine can obtain the disclosed information. No remote or privilege‑elevation pathways are supported by the available information.