The vulnerability exposes sensitive information to an unauthorized actor in Microsoft Graphics Component, allowing an authorized attacker to disclose information over a network. This flaw is identified as a CWE-200 type information disclosure weakness and can leak confidential data to parties that should not have access.

Affected systems include Microsoft Windows 10 versions 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, and 22H3, as well as Windows Server 2022 and Windows Server 2025 installations, both standard and Server Core editions.

The CVSS score of 6.5 places this flaw in the moderate severity range. The EPSS score of less than 1% indicates a very low probability of exploitation at the time of analysis, and the vulnerability is not listed in the CISA KEV catalog. The likely attack path requires an attacker with authorized access to the affected system to trigger the disclosure over a network interface; therefore, the threat is limited to environments where privileged users can interact with the graphics component.