An improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to read files that should be protected by the operating system's security policies. This vulnerability is a form of local information disclosure that could reveal confidential data to users with sufficient privileges. The weakness is classified as CWE‑59, pointer/reference manipulation.

Microsoft Windows 10 Version 21H2, Version 22H2, and Microsoft Windows 11 Versions 23H2, 24H2, 25H2, 26H2, and 26H1 are affected. The vulnerability applies to the x86, x64, and arm64 builds as indicated by the listed CPEs, affecting the backup engine component on each platform.

With a CVSS score of 5.5, the exploit is considered moderate. EPSS is not available and the CVE is not included in the CISA KEV catalog, suggesting that widespread exploitation is not yet documented. The attack requires an authorized local user with access to the backup engine, indicating that the vector is local and the privilege requirement is at least user level. Once the vulnerable component resolves a malicious link, it can read protected files, potentially exposing sensitive information.