The vulnerability arises from an uninitialized resource in the Dynamic Root of Trust for Measurement (DRTM) module, allowing authorized local users to read memory that was not intended for disclosure. This improper read of uninitialized memory is classified as CWE‑908 and results in leakage of confidential data to the attacker, but does not grant code execution or remote access.

Microsoft Windows 10 versions 1809, 21H2, 22H2; Windows 11 versions 22H3, 23H2, 24H2, 25H2; Windows Server 2019; Windows Server 2022 (including the 23H2 edition server core); and Windows Server 2025 (including server core). All listed editions are potentially affected unless a patch has been applied.

The CVSS base score is 4.4, reflecting moderate severity. The EPSS score is below 1 %, indicating a very low likelihood of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local, which is inferred from the description’s reference to an authorized attacker and is not explicitly stated in the CVE record. Exploitation requires local access and the ability to interact with the DRTM subsystem, so the impact is limited to the capabilities of the attacking user.