A local authorized attacker can exploit a flaw in the Windows Push Notification system that uses an uninitialized resource, causing confidential data to be exposed. The vulnerability is an instance of CWE-200, which allows the disclosure of information not intended for the attacker. The attacker stands to gain access to data that would otherwise remain protected by system access controls.

Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1; Microsoft Windows Server 2016, 2019, 2022 and 2025, including Server Core installations.

The CVSS score of 5.5 classifies this vulnerability as moderate, and the EPSS score is currently unavailable, indicating limited publicly known exploitation activity. The vulnerability requires a local, authorized user to trigger the information disclosure and is not remotely exploitable. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, further suggesting that it is under limited active exploitation. Overall, while the impact is not catastrophic, the moderate CVSS and lack of remote exploitation imply a moderate but non-negligible risk to affected installations.