Improper access control within the Windows Projected File System allows an attacker who has legitimate access to a system to read files that should be restricted. The flaw can be leveraged to enumerate or extract data from the projected file system, potentially exposing sensitive configuration files or user data. The vulnerability is limited to the local environment and requires the attacker to be authenticated or otherwise authorized on the affected machine.

Microsoft Windows 10 (versions 1809, 21H2, 22H2) and Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1) as well as Microsoft Windows Server 2019, 2022, and 2025, including both standard and Server Core installations. These include both x86 and x64 builds and arm64 variants where indicated.

The CVSS score of 5.5 indicates moderate severity; the lack of an EPSS score and absence from CISA’s KEV catalog suggest no widespread exploitation has been observed. The likely attack vector is local, requiring an authorised user or malicious process that can navigate the projected file system. Because the exploitation relies on improper access control, privileged processes are typical attackers, though any local user with sufficient rights to execute code could potentially leverage the vulnerability.