The vulnerability reveals that the Windows Event Viewer can expose files or directories to external parties when accessed by an authorized user, a classic Information Exposure flaw (CWE-552). An attacker who has legitimate rights to use Event Viewer can read sensitive log files or configuration data, leading to a confidentiality compromise. There is no evidence of privilege escalation or code execution in the description, so the damage is limited to data disclosure.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025 across all installation types and architectures (x86, x64, arm64).

The CVSS score of 6.5 indicates moderate severity; the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a local or remote attacker who already possesses authorized access (for example, a legitimate user or administrator). Once empowered to open Event Viewer, the attacker can extract the exposed directories or files. Because the vulnerability requires authorized access and no remote exploitation method is documented, the exploitability remains moderate and the threat is limited to users who can legitimately run Event Viewer.