The vulnerability permits an authorized local user to read files or directories that should not be publicly accessible through the Windows Defender Firewall Service. This results in the disclosure of potentially sensitive system information, exposing the integrity of system configuration and confidential data. The weakness is an insufficiently restricted access to local resources (CWE-552).

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 (including Server Core editions). Files affected are those associated with the firewall service on these platforms.

The issue carries a CVSS v3.1 score of 5.5, indicating moderate risk. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widely observed exploitation. An attacker must be authorized on the system and have at least local privileges that allow the attacker to invoke the firewall service. Once accessed, the attacker can read the exposed files; no remote or privilege escalation vector is described, so the attack surface is limited to local exploitation.