Technical impact
This vulnerability is an integer overflow or wraparound flaw (CWE-190) in the Windows Human Interface Device (HID) driver that permits an authorized local attacker to read sensitive data from memory. The flaw results in unintended data disclosure rather than denial of service or code execution. The weakness arises from improper bounds checking on integer values used to process HID data structures. As a result, an attacker who can trigger the overflow can potentially exfiltrate confidential information stored in the target system.
Affected Systems
The issue affects multiple Microsoft Windows editions, including Windows 10 1809, 21H2, 22H2; Windows 11 24H2, 25H2, 26H1; and Windows Server 2019, 2022, 2025. Both legacy x86/x64 and newer arm64 architectures are impacted across these releases.
Risk and Exploitability
With a CVSS base score of 4.7 and an EPSS score below 1%, the overall risk is moderate and the likelihood of exploitation is low. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread attacks. Based on the description, the attack vector is local; it requires an authorized user or a user with permissions sufficient to load or interact with HID drivers. An attacker would need to manipulate a HID device or drive a device to trigger the integer overflow to glean memory contents.
