The vulnerability is an out‑of‑bounds read in the Windows DWM Core Library that permits a local, authorized attacker to read memory contents that should not be exposed. The result is the disclosure of sensitive information on the compromised host, potentially including secrets or application data. This flaw is classified under CWE‑122 (Heap-based Buffer Overflow) and CWE‑125 (Out‑of‑Bounds Read).

Microsoft Windows 11 26H1, 64‑bit edition is affected. No further version granularity is specified beyond the quoted build number.

The CVSS score of 5.5 indicates a moderate risk when considering the confidentiality impact. The EPSS score is unavailable, so luck of exploitation in the wild cannot be quantified. Because the flaw requires that the attacker already has a legitimate local account, the attack surface is restricted to the victim’s own machine, and the vulnerability is not listed in the CISA KEV catalog. Unless the local user has elevated privileges, the exploit is difficult to achieve. Given these constraints, the threat remains moderate and confined to the victim’s environment.