The weakness stems from an uninitialized resource within the Windows Event Logging Service. When an authorized local user exploits this flaw, they can read data that the service stored in memory or in improperly initialized log files. This disclosure can expose sensitive configuration or audit information, thereby compromising confidentiality for the affected machine. The defect is categorized as CWE-908, meaning the application does not correctly initialize data before use.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Microsoft Windows Server editions 2012 through 2025, including all Server Core installations, are affected.

The CVSS score of 5.5 denotes a moderate severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. The attack requires local access with user or administrative privileges; an attacker must already be authenticated to the host. While the reach is limited to the local machine, the confidentiality loss can be critical if sensitive data is stored in the event logs.