An authorized attacker can disclose sensitive system information locally through Windows Hello. This disclosure can reveal device details and user information, as the vulnerability falls under CWE-497: Information Exposure. The impact is limited to local access but can still aid in further compromise.

Microsoft Windows 10 21H2 and 22H2, and Microsoft Windows 11 23H2, 24H2, 25H2, 26H2 and 26H1 are affected on x86, x64 and arm64 architectures, as described in the CNA notes and the listed CPE strings.

The CVSS score of 5.5 indicates a moderate severity. EPSS is not available, so current exploitation probability is uncertain; the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, requiring the attacker to have authorized access on the affected Windows installation to read sensitive system data.