An attacker with local authorized access can trigger a buffer over-read within the Windows kernel memory. This flaw allows the attacker to read kernel memory contents, leading to disclosure of sensitive information that is normally protected by the operating system.

Microsoft Windows 10 releases 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 releases 23H2, 24H2, 25H2, 22H3, and 26H1; and Microsoft Windows Server releases 2016, 2019, 2022, 2025, and the 23H2 edition are affected.

The CVSS score of 6.1 indicates a medium severity. Because the vulnerability can be exploited only by an authenticated local user, it does not pose a remote attack risk. The EPSS score is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not been observed. Nonetheless, local privileged users could potentially expose confidential data if the kernel memory contains sensitive structures.