Windows File Explorer CVE-2026-50442

The attacker must hold an authenticated local user session with at least low-privilege access on the target Windows system (PR:L per CVSS). The local attack vector (AV:L) requires physical console access or a remote desktop session already established under that user's credentials - remote unauthenticated exploitation is not possible. No non-default configuration prerequisite is identified in available data; the flaw appears present in standard File Explorer operation on affected builds. Exploitation is strictly confidentiality-limited with no integrity or availability impact (I:N/A:N). The primary limiting factor is the requirement for prior local authentication, which restricts exploitation to insider threat scenarios or post-compromise lateral disclosure by an attacker who has already achieved initial access.

The CVSS 3.1 base score of 5.5 (Medium) with AV:L/AC:L/PR:L is internally consistent with the threat model: low attack complexity but constrained to local authenticated sessions, significantly limiting the attacker population. EPSS at 0.36% (28th percentile) signals very low near-term weaponization probability, aligned with the SSVC assessment of exploitation=none and automatable=no. The vulnerability is not listed in the CISA KEV catalog. Despite the High confidentiality impact (C:H) in the CVSS vector-indicating potentially full disclosure of sensitive data accessible under the flaw-the local-only, authenticated-user prerequisite makes this an insider-threat or post-compromise disclosure scenario rather than a primary intrusion vector. All available signals are mutually consistent: this is not a high-urgency emergency but warrants inclusion in the next standard Windows patch cycle given the ubiquitous deployment footprint of File Explorer across every affected platform.

A low-privileged user already authenticated to a vulnerable Windows host interacts with Windows File Explorer in a standard session, causing the application to surface sensitive information-such as restricted file paths, metadata, or content from protected system locations-beyond what the user's permissions should allow. The attacker reads this exposed data directly without requiring additional privileges or triggering any further user interaction. No public exploit code has been identified and SSVC confirms no observed exploitation, making opportunistic in-the-wild attacks unlikely at this time.