An insufficient granularity of access control within the Windows Connected User Experiences and Telemetry component allows an attacker who has authorized local access to read disallowed data. The flaw is classified as CWE‑1220, indicating that permission checks are too permissive. An attacker can obtain proprietary telemetry and usage data that could leak personal or organizational information, and the impact is confined to the local system. The vulnerability does not permit remote execution, but it can provide sensitive data from the machine.

Microsoft Windows 10 versions 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2 and 26H1; Windows Server 2019, Server 2019 Server Core; Windows Server 2022; Windows Server 2025, and Windows Server 2025 Server Core installations. The affected build architectures include x86, x64 and arm64 variants.

With a CVSS score of 6.5 the vulnerability is considered moderate. No EPSS score is presently available, and it is not listed in the CISA KEV catalog. The attack vector is local, requiring an attacker who can execute code with user‑level privileges; the flaw stems from too broad permissions. Given that the vulnerability is local and does not provide escalation or remote code execution, the risk is limited to the information disclosed, but it is still advisable to remediate promptly to prevent any misuse of telemetry data.