The flaw is an out‑of‑bounds read in the Windows IKE Extension that permits an attacker who can send crafted IKE packets to an affected system to read memory contents and transmit the disclosed data over the network. This leads to a confidentiality compromise. The weakness is identified as an out‑of‑bounds read (CWE‑125).

Affected systems include Microsoft Windows 10 build 1607, 1809, 21H2, and 22H2; Windows 11 builds 23H2, 24H2, 25H2, 26H2, and 26H1; and Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both full and server‑core editions). No specific patch releases are listed in the input, so all versions covered are affected.

The CVSS score of 7.5 classifies the vulnerability as a high‑risk data‑exposure issue. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no documented exploitation yet. The likely attack vector involves network traffic to the IKE/ISAKMP ports, implying a remote attacker could exploit the flaw by sending malicious packets while the target system is running IKE. Without additional information, it is prudent to treat it as a potential remote information‑disclosure risk.