An out-of-bounds read has been discovered in the Windows Defender Firewall Service. The flaw allows a user with sufficient local privileges to read memory beyond intended boundaries, potentially exposing sensitive data on the affected system. The vulnerability is categorized as CWE-125, a classic overflow-based information disclosure weakness.

The flaw affects Microsoft Windows 11 releases 22H3, 23H2, 24H2, and 25H2, as well as Windows Server 2022 23H2 Edition (server core) and Windows Server 2025 (full and server core installations).

The CVSS score of 5.5 indicates moderate severity and the EPSS score of less than 1% suggests that the likelihood of exploitation is currently low. The issue is not listed in the CISA KEV catalog. Because the vulnerability requires a local attacker with authorization to interact with the Defender Firewall Service, the attack vector is inferred to be local. Exploitation would involve triggering the out‑of‑bounds read by sending crafted inputs to the service, after which the attacker could read arbitrary data residing in memory.