An out‑of‑bounds read flaw in the Windows TPM trustlet exposes local memory contents that an authorized attacker can read. The vulnerability is a buffer over‑read (CWE‑125) and allows the disclosure of potentially sensitive data, compromising confidentiality. It does not enable code execution or denial of service.

Affected are Microsoft Windows 10 versions 1809, 21H2, and 22H2, Windows 11 versions 22H3, 23H2, 24H2, and 25H2, and Windows Server releases 2019, 2022, and 2025, including server core installations.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of <1% reflects a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is local; an attacker must have authorized access to the target machine and the TPM subsystem. Proper bounds checking would prevent the read, but in its absence, the flaw allows disclosure of data stored beyond the intended buffer.