Improper access control in the Windows Notification subsystem enables an authenticated attacker with local privileges to read sensitive information that should be protected. The oversight allows disclosure of data present in the notification service, potentially revealing personal or confidential data without the need for remote exploitation. This vulnerability falls under the privilege escalation and information disclosure category, represented by CWE‑306.

Microsoft Windows 10 (versions 1809, 21H2, 22H2) and Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1) are susceptible, as are Windows Server 2019, Server Core installations, Windows Server 2022, and Windows Server 2025 including Server Core.

The CVSS score of 5.5 indicates a medium severity risk. No EPSS data is available, so the exact likelihood of exploitation is unknown, but the vulnerability is not listed in the CISA KEV catalog, suggesting no currently observed or widespread attacks. An attacker who is authorized locally, such as a user or a compromised local account, can exploit the issue via the notification APIs or related services to extract sensitive information. The impact is limited to the local environment and does not provide remote code execution or system compromise beyond information disclosure.