Windows File Explorer contains a flaw that allows an authorized local user to disclose sensitive information to an unauthorized actor. This weakness is identified as CWE‑200 and can result in the exposure of data that should otherwise be protected.

The vulnerability affects many Microsoft Windows operating systems. Supported versions include Windows 10 build 1607, 1809, 21H2 and 22H2; Windows 11 builds 24H2, 25H2 and 26H1; and Windows Server releases from 2012 through 2025, including Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 2022 and Server 2025. The flaw is present on 32‑bit and 64‑bit Windows 10, on 64‑bit Windows 11 26H1, on ARM64 Windows 11 24H2 and 25H2, and on 64‑bit Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1 % suggests that the likelihood of exploitation in the wild is very low at present, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local; an attacker with legitimate local access can trigger the flaw, but there is no evidence of a remote exploitation path.