A flaw in Microsoft Defender’s handling of hyperlink references allows an attacker with user‑level privileges to access files that the defender normally protects. This improper link resolution can expose sensitive data stored on the local machine and could be leveraged to gather credentials or other confidential information. The weakness is classified as CWE‑59 – Improper Restriction of Operations within the Bounds of a Memory Buffer.

The vulnerability affects Microsoft Windows Defender on all Windows operating systems that include this feature. No specific version constraints are listed in the advisory, so any installation of Windows Defender is potentially impacted until a patch is applied.

The CVSS score of 5.5 indicates a moderate risk. Because the EPSS score is not published, the likelihood of exploitation cannot be quantified, and the flaw is not listed in CISA’s KEV catalog. The attack requires local, authorized access; thus, an attacker who has user privileges on the compromised machine can trigger the flaw, though it would not provide remote code execution or system‑wide compromise. The primary concern is the leakage of protected files rather than disruption of service.