The vulnerability arises from improper link resolution before file access in the Windows Update Orchestrator Service. An attacker with authorized local privileges can exploit this issue to read files that should be protected, resulting in the disclosure of sensitive data. The flaw fits the CWE‑59 pattern, where an application fails to validate or sanitize a filesystem path before following it.

Microsoft Windows 10 21H2, 22H2, Windows 11 23H2‑26H2 including 26H1, Windows Server 2022, and Windows Server 2025 (standard and core installations) are impacted. The affected versions are listed in the CNA data and include the ARM64 and x64 binaries for the specified releases.

The CVSS base score of 5.5 indicates moderate severity, with the primary impact of local information disclosure. EPSS is not available, but the lack of a KEV listing suggests no widespread exploitation has been reported yet. Based on the description, an attacker must have authorized local access to trigger the orchestrator service, which is a common privilege level on many systems. This vulnerability is limited to users who are already authenticated and can interact with the service; there is no remote or unauthenticated entry point described.