The vulnerability allows a local, authenticated user to read sensitive data that is transmitted in Windows Push Notification messages. When the notification payload contains confidential information, the data is exposed to the user through the notification subsystem, violating confidentiality. The weakness is a standard information‑disclosure flaw (CWE‑200). No elevation of privileges or remote code execution is possible; the attacker must already possess valid local credentials to exploit it.

The problem affects a wide range of Microsoft Windows operating systems. Clients include Windows 10 builds 1607, 1809, 21H2, 22H2 and Windows 11 builds 24H2, 25H2, 26H1, spanning x86, x64, and ARM64 architectures. Servers are impacted from Windows Server 2016 (both standard and Server Core) through Windows Server 2025 (both standard and Server Core). Each version is listed in the Microsoft update guide linked in the references.

The CVSS base score of 5.5 indicates a moderate risk level. An EPSS score of less than 1% shows that the likelihood of widespread exploitation is low, and the vulnerability is not cataloged in the CISA KEV list. Exploitation requires a legitimate local session; an attacker must first authenticate to the target system. If the Push Notification Service is disabled or the vendor patch applied, the risk is eliminated.