The vulnerability stems from Cortana's ability to listen for commands even while the PC is locked, combined with regular indexing that makes files accessible in the search function that Cortana uses. Even though potential hackers would need physical access to your PC to do any damage, this could feasibly take place in an office or shared environment. Microsoft dealt with the issue in yesterday's "Patch Tuesday" update, but many machines won't have that yet, so McAfee suggests turning off Cortana on the lock screen to prevent any attacks.