An out‑of‑bounds read bug in Windows Network Driver Interface Specification (NDIS) can allow an attacker with physical access to read sensitive memory contents, leading to information disclosure. The flaw is classified as CWE‑125 and does not provide remote code execution or privilege escalation, but it can expose data that should remain confidential.

The vulnerability affects a wide range of Microsoft Windows products, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 22H3; and Windows Server editions from Server 2008 R2 SP1 through Server 2025, both on Server Core and full installations.

The CVSS base score of 4.3 indicates moderate severity. The EPSS score of less than 1% and absence from the CISA KEV catalog suggest that exploitation is unlikely in the wild. The attack likely requires the attacker to have physical possession of the device and to trigger the specific NDIS condition; this limits the practical threat to environments where physical security is insufficient.