Out-of-bounds read in Application Information Services can be leveraged by an attacker with local authorized access to read memory beyond intended bounds. This flaw allows the attacker to gain privileges higher than those granted, potentially enabling execution of arbitrary code or full system control. The vulnerability is classified under CWE‑125, highlighting a failure to prevent memory overreads that can compromise integrity of the operating system.

The flaw affects Microsoft Windows 11 versions 24H2 and 25H2 on both standard and arm64 architectures, as well as Microsoft Windows Server 2025, including Server Core installations. Exact service names are not listed, but the vulnerability resides in the Windows Application Information Service component across these releases.

The CVSS score of 7.8 indicates a high severity, while the EPSS score of less than 1% suggests a low likelihood of widespread exploitation at this time. The vulnerability is not currently catalogued in CISA KEV. The attack vector is local; an attacker already authenticated to the system must exploit the out‑of‑bounds read in the Application Information Service to elevate privileges. Because the flaw is memory‑related, it is likely easier to exploit than more complex remote code paths, but the requirement for local authorization limits its scope to compromised or privileged hosts.