An out-of-bounds read in the Windows GDI+ graphics subsystem allows an attacker to read unintended memory contents and transmit that data over a network, leading to the disclosure of sensitive information. The weakness is formally classified as CWE-125, representing a buffer over-read. No Privilege Escalation or code execution occurs; the impact is limited to the leakage of memory resident data.

The flaw affects Microsoft Windows 10 releases 1607, 1809, 21H2 and 22H2, as well as Windows 11 releases 23H2, 24H2, 25H2, 22H3 and 26H1. It also applies to all Windows Server editions from 2012, 2012 R2, 2016, 2019, 2022 through 2025, inclusively covering both standard and Server Core installations.

The vulnerability carries a high severity rating (CVSS 7.5) but a very low likelihood of exploitation (EPSS <1%) and is not listed in the Known Exploited Vulnerabilities catalog. The likely attack vector is that an unauthorized user crafts a malicious image or graphic file that causes GDI+ to process the file and trigger the over‑read, then captures the leaked data for exfiltration. At present, no public exploits have been reported, and the exploit would require the victim to open or process the craft image, making the attack somewhat dependent on user interaction.