Use of externally-controlled format string in Windows Inventory Backup allows an authorized attacker to disclose information locally.
CWE-134