This vulnerability arises from improperly secured permissions on the MSI NBFoundation Service named pipe, MSI_SERVICE_2. A remote attacker can connect to the pipe and read sensitive data exposed by the service. The flaw leads to an information disclosure that compromises the confidentiality of the data handled by the service. Based on the description, the likely attack vector is remote via inter‑process communication through a named pipe.

The affected product is the MSI NBFoundation Service, version 2.0.2506.1201, distributed by MSI. No additional vendor or product versions are listed in the CNA data.

The CVSS score is not provided, and the EPSS score is unavailable. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a remote actor to connect to the MSI_SERVICE_2 pipe, which can be accessed without authentication due to insecure permissions. The risk is primarily a loss of confidentiality; there is no evidence of impact on integrity or availability.