An unauthorized control sphere can read sensitive system information from the Windows Clipboard User Service because the service does not properly validate who can query clipboard data. The flaw allows an attacker who already has local access on the target machine to obtain the contents of the clipboard, which may contain passwords, tokens, or other confidential data. This compromise is limited to local disclosure; there is no evidence that remote exploitation is possible.

Microsoft Windows 10 Version 1809, 21H2, 22H2; Microsoft Windows 11 Version 23H2, 24H2, 25H2, 26H2, 26H1; Microsoft Windows Server 2019; Microsoft Windows Server 2022; Microsoft Windows Server 2025, including Server Core installations

The CVSS score of 5.5 indicates moderate severity, and the vulnerability is only exploitable by an attacker with local privileges. Because no EPSS score is available and the issue is not listed in the CISA KEV catalog, the likelihood of widespread exploitation at present appears low. Nonetheless, the impact on confidentiality of sensitive clipboard data warrants timely remediation. The likely attack vector is local: an attacker who can log into the machine or inject code locally can read clipboard contents through the vulnerable service.