The Windows Shell component in several Windows operating systems exposes sensitive data to an unauthorized actor, allowing an authorized attacker with local access to read information that should remain confidential. This flaw is classified as CWE-200, a classic information‑disclosure weakness that can lead to confidentiality loss for users on the affected machine.

Affected versions include Windows 10: 1809, 21H2, 22H2; Windows 11: 23H2, 24H2, 25H2, 26H1; and Windows Server: 2019, 2022, 2025, including Server Core installations. These systems are listed in the official Microsoft update guide for CVE‑2026‑42907.

The flaw carries a CVSS score of 6.5, indicating moderate severity. EPSS information is not available, so the exploitation likelihood is unknown, but the description makes it clear that the attack vector is local. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread public exploitation has been reported. Nonetheless, any local user who gains authorized Shell access could potentially disclose protected information, creating a risk to confidentiality even though the impact is limited to the local environment.