The vulnerability arises because the Windows AppX Deployment Service resolves symbolic links before performing file access, which permits a local user with authorization to request files that may reside outside the intended AppX package scope. This flaw allows the attacker to read sensitive files stored on the same system. The weakness is classified as CWE‑59: Improper Restriction of Operations within the Bounds of a Resource.

Affected products include Windows 10 versions 21H2 and 22H2, Windows 11 versions 23H2 through 26H2 (including ARM64 variants 23H2, 24H2, 25H2, 26H2), Windows 11 version 26H1, Windows Server 2022, and Windows Server 2025 (both standard and Server Core installations).

The CVSS score of 4.7 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting it is not widely exploited. The likely attack vector is local; an authorized user or service with sufficient privileges can trigger the flaw to read protected files. Because the flaw does not grant remote code execution or privilege escalation, the risk is confined to information disclosure on the compromised host.