The vulnerability is an out‑of‑bounds read in the Windows Internet Connection Sharing (ICS) component of Windows operating systems. An attacker who gains physical access to a device can trigger the flaw to read arbitrary data from memory, potentially exposing sensitive information. This weakness is classified as CWE‑125, an out‑of‑bounds read that can lead to information disclosure.

Affected systems encompass a broad spectrum of Windows releases, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 22H3; and Windows Server editions ranging from 2008 R2 and 2008 SP2 to 2025. All listed operating systems, both client and server, are susceptible to this flaw.

The CVSS score is 4.6, indicating low severity, and the EPSS score is below 1%, reflecting a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, and there are no publicly disclosed exploits. Because the flaw requires physical access to the device, the risk is primarily for environments where an attacker can approach the hardware, such as shared workstations or devices left unattended. Nonetheless, organizations should treat this as an information‑disclosure risk that can be mitigated with an update.