An uninitialized resource in Windows Modern Device Management (MDM) can be exploited by an authorized local user to reveal sensitive information. The flaw falls under CWE-170, indicating that data may be retrieved from an undefined state, and CWE-908, which points to inadequate verification of sensitive fields. The data exposed can include configuration details, user credentials, or other high‑value artifacts that an attacker could leverage for further compromise.

The vulnerability affects a wide range of Microsoft operating systems, including Windows 10 versions 1809, 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1, as well as Windows Server editions 2019, 2019 (Server Core), 2022, 2025 and 2025 (Server Core). All affected releases that implement the Microsoft Modern Device Management interface are susceptible.

With a CVSS score of 5.5 the vulnerability is considered moderate; it does not have a high exploitability rating and is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score is unavailable, implying no publicly documented exploits. The attack vector is inferred to be local – the attacker must be authorized on the target machine to trigger the uninitialized resource and read the data. Therefore, the risk is significant primarily within environments where privileged or local users have access to the MDM component.