The vulnerability in Windows NTFS permits an attacker who already has authorized local access to read sensitive system data that should be protected. This flaw exposes confidential information and is classified as a sensitive information exposure (CWE-497). The CVSS score of 5.5 indicates a moderate risk to confidentiality but does not suggest the ability to execute code or cause denial of service.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and several Windows Server releases such as 2012, 2012 R2, 2016, 2019, 2022, 2025, along with their Server Core installations and ARM64 variants.

The vulnerability is local and requires the attacker to possess authorized system access to exploit it. The potential leakage of confidential NTFS metadata could enable an attacker to gain further footholds or detail system configuration. The EPSS score of less than 1% indicates a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. The CVSS score of 5.5 reflects moderate risk primarily to confidentiality, with no impact on integrity or availability.