The vulnerability is an absolute path traversal flaw in Microsoft Windows' Encrypting File System (EFS). An attacker who is authorized on the system can use the flaw to read files or directories outside the intended EFS scope, resulting in the disclosure of sensitive data that should be protected by encryption and access controls.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2 and Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1 are all affected, as are Windows Server 2012 (full and core), 2012 R2 (full and core), 2016, 2019, 2022, and 2025.

The CVSS base score of 6.5 indicates moderate‑to‑high risk. The EPSS score is 1%, indicating a low but nonzero probability that the vulnerability will be exploited. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread public exploits. Based on the description, it is inferred that an attacker with legitimate local or network access to the affected system might exploit the path traversal to read confidential EFS data, making the attack both feasible and potentially impactful.