This vulnerability in the Windows Client Side Caching driver (csc.sys) allows an attacker with local authorization to read sensitive data that should be protected, such as configuration or cache contents. The flaw arises because the driver does not properly restrict access to certain memory areas, leading to disclosure of confidential information. The underlying weakness corresponds to CWE-497, an improper access control issue.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 (including Server Core editions). All affected Windows operating systems, whether 32‑bit, 64‑bit, or arm64, are covered by the CNA vendor/product list.

The CVSS score of 5.5 indicates a medium-level severity. No EPSS score is reported and the vulnerability is not listed in CISA's KEV catalog, suggesting that exploitation activity is currently limited. Based on the description, it is inferred that the vulnerability can only be abused by users with local access and does not rely on a remote entry point. Because the flaw is local, an attacker who can log into the target system can potentially read protected data, posing a moderate risk of information leakage if the affected system has sensitive information cached.