The flaw resides in the Windows Shell and permits an attacker who already has legitimate user access to obtain sensitive system information, such as user names, environment variables, or configuration details. This disclosure undermines confidentiality and can serve as foothold information for further attacks. The weakness is classified as CWE-497, reflecting a serious information exposure issue within a trusted component.

Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 duplicate and 26H1; Windows Server 2012 R2, 2016, 2019, 2022 and 2025 including core installations. All processor architectures listed (x86, x64, arm64) are impacted as indicated by the vendor and CPE references.

The CVSS score of 4.7 places the vulnerability in the low‑to‑medium category. Because the attacker must already be authenticated to use the Windows Shell, the attack vector is local and privilege‑based; remote exploitation is not supported by the description. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation activity. Overall, while the impact is limited to confidential data exposure, the requirement for local access and absence of readily exploitable remote vectors means the risk is moderate.