Executive brief
A security vulnerability in Windows File Explorer could allow an unauthorized person with physical or local access to a computer to view sensitive information. This occurs when the system fails to properly clear memory or resources before they are reused. To exploit this, an attacker would typically need to convince a user to perform a specific action, such as opening a malicious file or folder.
Technical details
A vulnerability classified as CWE-908 (Use of Uninitialized Resource) exists in Windows File Explorer. The flaw stems from the application failing to properly initialize a resource or memory buffer before it is accessed, which can lead to the disclosure of sensitive information from memory. An attacker can exploit this locally by convincing a target user to interact with a specific file or directory (User Interaction required). Successful exploitation results in high confidentiality impact but does not allow for data modification or service disruption. Microsoft has released security updates to address this issue across affected Windows and Windows Server versions.
Affected products
- Microsoft Windows 10 1607, 1809, 21H2, 22H2
- Microsoft Windows 11 24H2, 25H2, 26H1
- Microsoft Windows Server 2012 All versions
Timeline
- 2026-07-14: disclosed
- 2026-07-14: advisory