An out‑of‑bounds read occurs in Windows' Push Message Routing Service, allowing an authorized attacker to read data beyond the expected buffer. The flaw can expose sensitive information that resides in memory, such as credentials, cryptographic material, or other confidential data. The CVE description does not indicate code execution or privilege escalation; it solely describes local information disclosure.

The vulnerability affects Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 versions 22H3, 23H2, 24H2, 25H2, and 26H1. Each of these builds is listed in the CNA affected‑version data and matches the corresponding CPE entries.

The CVSS score of 5.5 classifies the severity as moderate. The EPSS score of less than 1% suggests that widespread exploitation is unlikely under normal conditions. The flaw is not included in the CISA KEV catalog, indicating no public exploitation has been documented. Based on the description, it is inferred that the attack vector is local, meaning that an attacker must already have local access to the target system to exploit the read. This limits the threat to users with local authority, but the ability to read arbitrary memory can aid in future attacks if additional information is gathered.