The vulnerability is a missing authentication check in the Windows Health and Optimized Experiences Service. An attacker with authorized local rights can invoke a critical function and receive sensitive information that should be protected. The weakness is a classic missing authentication flaw (CWE‑306).

Microsoft Windows 11 24H2, 25H2, 26H2, and 26H1 when running on arm64 hardware are affected by the missing authentication in the Health and Optimized Experiences Service. Any system with this service enabled on those versions could be compromised.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV. The likely attack vector is local; an attacker must have local user privileges to exploit the missing authentication check. No remote exploitation is described, but attackers who gain local access can disclose information within the scope of the vulnerable service.