The vulnerability permits exposure of private personal information stored in Azure Active Directory to an unauthorized actor who can discover the data locally. This local information disclosure relates to CWE‑359 and allows an attacker to gather personal data that could be used for privacy violations or credential harvesting. The impact is limited to the confidentiality of personal data but can affect user privacy on the affected systems.

Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1 and Microsoft Windows Server 2025 (including Server Core installations) are affected. These products are impacted across both x64 and arm64 platforms as listed by the vendor.

The CVSS score of 6.2 indicates moderate severity. No EPSS score is available, and the vulnerability is not in the CISA KEV catalog. The likely attack vector is local; an attacker with local access or control can exploit the flaw to read Azure AD personal information. Exploitation requires no special network exposure and may already be possible if the system is running an unpatched version of the affected Windows releases.