This vulnerability is an improper access control flaw in the NTFS file system that allows an attacker with authorized local access to read data they should not be able to. The flaw can lead to the disclosure of sensitive system or user information residing in NTFS metadata or protected directories. The CVSS score of 5.5 indicates a moderate risk and suggests that an attacker could gain unauthorized knowledge of system state or private files, potentially compromising confidentiality.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Microsoft Windows Server 2016, 2019, 2022, and 2025, including their Server Core installations. No additional version details are provided beyond those listed.

The CVSS score of 5.5 reflects moderate severity, and because the EPSS score of 0.00342 (<1%) and the vulnerability is not listed in the CISA KEV catalog, exploitation is considered less likely to be widespread. The attack vector is local; the flaw requires an attacker to be logged on or have the ability to launch code on the affected machine. Under these conditions, the attacker could read restricted NTFS data, leading to a confidentiality issue. Patching remains the recommended mitigation, as the vendor has not supplied a workaround.