Improper access control in Windows Error Reporting allows an authorized attacker to disclose information locally. The flaw permits reading of error logs that should be protected only to privileged users, potentially revealing sensitive configuration data or user activity.

Microsoft Windows 10 versions 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, Windows Server 2019, Server Core variants, Windows Server 2022, and Windows Server 2025, Server Core variants.

The CVSS score of 5.5 indicates moderate severity, with no EPSS data available and the vulnerability not listed in the CISA KEV catalog. The attack vector is local and requires an attacker to already have authorized access to the system. While the flaw does not enable exploitation across the network or privilege escalation, it can lead to exposure of sensitive information within the compromised workstation or server.