An integer underflow (wraparound) in the Windows DWM Core Library allows a local authorized attacker to read protected kernel memory, exposing sensitive data such as cached passwords or cryptographic material. The flaw is an out‑of‑bounds read (CWE‑125) caused by integer overflow or wraparound (CWE‑191). Only a user with elevated privileges can trigger the error, but once triggered, they can gain local information disclosure.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; as well as Windows Server 2016, 2019, 2022, and 2025, including their Server Core installations. This includes both x86 and x64 architectures and ARM64 in Windows 11.

The CVSS score of 5.5 denotes moderate severity, while an EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attack requires local privileged access to invoke the DWM API that triggers the underflow, after which the attacker can read kernel memory.