The vulnerability arises from improper authorization in the Windows Broadcast DVR User Service, allowing an attacker with local authorized access to disclose sensitive information. This flaw corresponds to CWE-441 and carries a CVSS score of 6.5, indicating a moderate severity for local attackers. The impact is limited to information disclosure at the local level and does not provide remote execution or broader compromise.

Affected systems include Microsoft Windows 10 versions 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Microsoft Windows Server 2019 (standard and Server Core installations).

The vulnerability is exploitable only by users who already have authorized local access; remote exploitation is not supported. Its CVSS score of 6.5 reflects a moderate risk when local privileges are present. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog, suggesting that targeted exploitation is unlikely but not impossible within impacted environments.