A time‑of‑check time‑of‑use race condition exists in Windows SmartScreen that lets an authorized local user read sensitive data. The flaw does not give an attacker elevated privileges or remote access; it simply allows the exploitation of a timing window between a permission check and the subsequent use of that permission. The information disclosed can include locally stored data that could aid further attacks.

All Windows 11 builds from 23H2 through 26H1 are affected, including the 23H2, 24H2, 25H2, and 26H1 releases on both arm64 and x64 platforms.

The CVSS score of 4.7 indicates a moderate severity; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local and authorized, requiring the attacker to already have user or system access to the machine. Because the flaw is a toctou race, it is not easily exploitable under normal operation without intentional manipulation of the timing conditions.