An authorized local attacker can read sensitive system information by exploiting a flaw in Windows Cryptographic Services. The vulnerability allows the disclosure of confidential data through the cryptographic subsystem, which can compromise the confidentiality of the local system. The weakness is identified as CWE-497, a failure to ensure adequate protection of information.

The flaw affects multiple Microsoft Windows releases, including Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025. The affected builds span x86, x64, and ARM64 architectures.

The measured CVSS score is 5.5, indicating moderate severity. No EPSS score is currently available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local authorization and does not present a remote attack vector, limiting the attack scope to users who already have privileges to interact with the system.