The vulnerability occurs in the Local Security Authority Subsystem Service (LSASS) in Microsoft Windows operating systems. It allows an attacker to read sensitive information stored in LSASS memory, which can include credentials, configuration data, or other confidential details. The flaw is a buffer over‑read, identified as CWE‑126, and results in information disclosure.

Affected releases include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 22H3; and Windows Server 2016, 2019, 2022, 2025, and the 23H2 edition, including Server Core installations. These editions cover both desktop and server environments across multiple processor architectures.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is published and the vulnerability is not listed in the CISA KEV catalog, suggesting no documented public exploits exist at present. The description implies that local or privileged user context is required to exploit the flaw; this inference is based on the protected nature of LSASS memory. Therefore, an attacker with local or administrative access could potentially read the disclosed data. Prompt application of the vendor patch is the recommended mitigation.