An error message generated by the NTFS file system contains sensitive information. An attacker with authorized local privileges can trigger this error and obtain data not intended for them. The flaw is a classic information‑disclosure vulnerability, classified as CWE‑209. This flaw does not allow code execution or privilege escalation; it merely leaks data visible to the local user who invokes the NTFS path causing the error.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Microsoft Windows Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 2022, Server 2025. The affected builds include x86, x64, and arm64 architectures as listed by Microsoft.

The CVSS score of 4.7 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting low exploitation likelihood. The likely attack vector is local, requiring an authenticated user with file‑system access. No remote code execution or privilege escalation is possible. If an attacker can trigger the error, they can read the disclosed data only on the host where the attack occurs.