The Windows Clipboard User Service contains an incorrect authorization check that permits a local user with legitimate privileges to read data that should otherwise be protected. The flaw results in a local information disclosure, potentially exposing sensitive clipboard contents and compromising confidentiality. This weakness is classified as CWE-863, indicating an inconsistency in authorization decisions.

Affected by CVE‑2026‑83764 are several Windows operating systems, including Windows 10 versions 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2019 (both full and Server Core installations), Windows Server 2022, as well as Windows Server 2025 (including Server Core).

The CVSS score of 5.5 indicates a medium severity for this local information disclosure. EPSS data are not available, suggesting no current estimate of exploitation probability, while the vulnerability is not listed in the CISA KEV catalog. Because the attack requires local authorized access, it is unlikely to be exploited remotely. An attacker who can log into the affected system could read clipboard data, potentially revealing confidential information, but the risk is confined to the local machine and does not lead to remote code execution or broader compromise.