An out‑of‑bounds read in the Windows Desktop Window Manager core library enables a local attacker with authorized access to read memory contents that should be protected. This information disclosure could expose sensitive data such as credentials stored in memory or other confidential information. The vulnerability is a classic out‑of‑bounds read flaw identified as CWE‑125.

Microsoft Windows 11 24H2, 25H2, and 26H1 as well as Windows Server 2025 and its server core installation are affected. The affected builds include ARM64 for the 24H2 and 25H2 releases and x64 for the 26H1 release, as specified by their CPE entries.

The CVSS score of 5.5 indicates moderate severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The attack requires local, authorized user privileges, so the threat largely depends on the privileges granted to the user. Because the vulnerability does not allow remote exploitation, the risk to unprivileged users is limited.