An out‑of‑bounds read in the Windows Telnet client can be triggered by an unauthenticated attacker sending specially crafted data over the network. The flaw allows the attacker to read memory contents that should be inaccessible, thereby exposing sensitive information on the affected system. This weakness is classified as CWE‑125 and results in information disclosure rather than code execution or denial of service.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 22H3, 23H2, 24H2, 25H2, and 26H1; Windows Server 2012 and 2012 R2 (both Server Core installations), Windows Server 2016 and 2016 (Server Core installation), Windows Server 2019 and 2019 (Server Core installation), Windows Server 2022 and 2022 (Server Core installation), Windows Server 2025 and 2025 (Server Core installation), and the Server 23H2 edition (Server Core installation). The vulnerability also affects arm64 variants of Windows 11 and x64 variants of Windows 10 and Windows 11.

The CVSS score is 5.4, indicating moderate severity. EPSS is not available, so the exploitation likelihood is uncertain, but the lack of an EPSS score does not negate potential risk. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit it by connecting over the network to the Telnet service, delivering malicious input, and observing leaked data. Because the flaw requires only network access and no elevated privileges, any device running a vulnerable Telnet client on a reachable network is potentially at risk.