An out-of-bounds read exists in the Windows Telephony Service that allows an attacker who has local authorization to read memory beyond bounds and disclose sensitive information. The flaw is a classic CWE‑125 read‑after‑free type error, which can leak private internal data. Because the attacker needs local privileges, the risk is limited to machines that have compromised or privileged local accounts.

Microsoft Windows 10 (builds 1607, 1809, 21H2, 22H2) and Microsoft Windows 11 (builds 23H2, 24H2, 25H2, 26H1) are affected, as well as Microsoft Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025. All listed editions, including Server Core installations, are impacted. The vulnerability applies to both x86 and x64 architectures, with some ARM64 versions also affected.

The CVSS score is 5.5, indicating a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not been widely exploited in the wild. Attackers would need to be authenticated locally to trigger the read, so the primary attack vector is local. The impact is confidentiality compromise rather than execution or denial of service.