An out‑of‑bounds read in Capability Access Management Service (camsvc) permits an attacker who is already authorized on the system to read memory contents. This error results in disclosure of sensitive data that the attacker can access locally, and is identified as CWE‑125, indicating an arbitrary read vulnerability. The impact is limited to disclosure of confidential information; it does not provide code execution or denial‑of‑service capabilities.

Microsoft Windows 11 Version 24H2, Windows 11 Version 25H2, Windows Server 2022 23H2 Edition (Server Core installation), Windows Server 2025, and Windows Server 2025 (Server Core installation).

The vulnerability carries a CVSS score of 5.5 and an EPSS score of less than 1 %, indicating a moderate severity and very low probability of exploitation. It is not listed in the CISA KEV catalog. The attack vector is inferred to be local: an attacker must have legitimate access to the host, with sufficient privileges to interact with the camsvc process. No public exploit has been reported, and the risk is confined to the local user’s information disclosure. The overall risk is moderate, with the primary concern being potential exposure of confidential data within the scope of the attacker’s local permissions.