The Windows Portable Device File System Driver contains a type‑confusion flaw where an attacking process can access a resource using an incompatible type. This causes sensitive data to be exposed to a local, authorized attacker. The weakness is classified as CWE‑843, which represents a type mismatch that can lead to information leakage.

The flaw affects Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions including 23H2, 24H2, 25H2, 26H2, 26H1, and all Windows Server releases from 2012 through 2025. All corresponding x86, x64, and arm64 builds listed in the CNA data are vulnerable.

With a CVSS score of 5.5 the vulnerability falls into the medium severity range. No EPSS data is available and the issue is not listed in the CISA KEV catalog, indicating a moderate exploitation likelihood under current threat intelligence. The attack requires local authorization; external attackers cannot exploit the flaw without first obtaining valid local credentials, so the surface of exposure is limited to trusted users or compromised systems.