A buffer over‑read occurs in the Windows Broadcast DVR User Service, allowing an attacker who has local system access to read memory that should be protected. The flaw maps to CWE‑126 and results in the disclosure of potentially sensitive data from the host. The vulnerability does not enable remote code execution or privilege escalation; it only exposes information present in the local memory of the affected system.

Microsoft products including Windows 10 version 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2019 (including Server Core). The affected builds cover both x86 and arm64 architectures.

The CVSS score of 5.5 indicates a moderate impact, and the lack of an EPSS score and KEV listing suggest lower exploitation likelihood. The attack vector is local: an authorized user or one who has already bypassed isolation controls can trigger the buffer over‑read. Once the flaw is exercised, the amount of data that can be read depends on the service’s memory layout but is constrained to the region of the user service memory.