The vulnerability is a buffer over-read in Windows Print Spooler components. An authenticated local user with sufficient privileges can trigger the flaw and cause memory to be read beyond the intended buffer boundaries. This results in the disclosure of information residing in the Print Spooler process's memory space. This vulnerability is classified as CWE‑126, a Buffer Over-read weakness. Based on the description, it is inferred that an attacker could read arbitrary data in that memory, which may include sensitive information.

Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 24H2, 25H2, and 26H1; Windows Server editions 2019, 2022, and 2025, including Server Core installations. Affected builds cover 32‑bit, 64‑bit, and ARM64 architectures where applicable.

The CVSS score is 6.1, indicating moderate severity, and the EPSS score is less than 1 %, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. No remote trigger or elevated privileges are required; the attacker must first be authenticated locally and able to invoke the Print Spooler service. Once the over‑read is achieved, arbitrary data in the same process space can be read.