This vulnerability (CVE-2026-42906) involves an exposure of sensitive information (CWE-200) in the Windows Shell component of Microsoft Windows 10 Version 21H2 (build 10.0.19044.0). An authorized local attacker with low privileges can exploit this flaw to disclose sensitive information without requiring user interaction. The CVSS v3.1 base score is 5.5 (medium severity), reflecting the local attack vector, low complexity, and high confidentiality impact. Microsoft has released an official fix for this vulnerability as documented in their security update guide.

An authorized local attacker can disclose sensitive information from the affected Windows Shell component, potentially leading to information leakage. The vulnerability does not allow integrity or availability impacts, nor does it allow remote exploitation or require user interaction.

Microsoft has released an official fix for this vulnerability. Users and administrators should apply the security update provided by Microsoft for Windows 10 Version 21H2 (build 10.0.19044.0) as soon as possible to remediate this issue. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42906 for detailed patch information and update instructions.