The vulnerability in Microsoft Trace Data Helper permits a local, authorized attacker to expose sensitive system information that should otherwise remain protected. The description indicates that trace data can be accessed by an unauthorized control sphere, resulting in information disclosure. This flaw is classified under CWE‑497, reflecting improper trust or handling of system data.

Affected Microsoft products include Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 23H2, 26H1), and Windows Server releases from 2012 through 2025. All listed editions, including Server Core installations and ARM64 or x86 variants, rely on the same Trace Data Helper component.

The CVSS score of 5.5 indicates a medium severity for local information disclosure. The EPSS score is not available, so the exact likelihood of exploitation is uncertain, though the absence of a CISA KEV listing suggests no widespread exploitation has been observed. Based on the description, the attack vector is inferred to be local, requiring authorized or privileged access to the affected system.