A buffer over-read in the Windows DWM Core Library enables an authorized local attacker to read memory beyond the intended buffer bounds, potentially revealing sensitive data that resides in memory. The defect is classified as a buffer-overread weakness (CWE-126) and results in confidentiality compromise only for information that the local attacker can access. No denial of service or code execution is described in the current details.

Microsoft Windows 10 1607, 1809, 21H2, 22H2; Windows 11 23H2, 24H2, 25H2, 22H3, 26H1; Windows Server 2016, 2019, 2022, 2025, 23H2 editions are affected. The vulnerability applies to both Intel and AMD 32‑bit, 64‑bit, ARM64 builds as listed in the CPEs.

The CVSS score of 7.8 indicates a high severity vulnerability, while the EPSS score is not available, so the current likelihood of exploitation is unknown. The vulnerability is not listed in CISA's KEV catalog. The likely attack vector is local, requiring an authorized user with permission to run code that interacts with the DWM library; remote or unauthenticated exploitation is not indicated by the data provided.