Composite Image File System driver (cimfs.sys) Information Disclosure Vulnerability
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.5epss 0.3%
exploitation probability
0.3%top 79% of all CVEs
observed exploitation
nono source reports it
Access of resource using incompatible type ('type confusion') in Composite Image File System Driver allows an authorized attacker to disclose information locally.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Affected products
Microsoft · Windows 10 Version 21H2Microsoft · Windows 10 Version 22H2Microsoft · Windows 11 Version 24H2Microsoft · Windows 11 Version 25H2Microsoft · Windows 11 version 26H1Microsoft · Windows Server 2022Microsoft · Windows Server 2025Microsoft · Windows Server 2025 (Server Core installation)