The issue is an out‑of‑bounds read in the Windows Remote Desktop Protocol stack that lets an unauthenticated attacker read memory values from the target system, potentially exposing confidential data. The weakness is classified as CWE‑125. The disclosed data could include user credentials, cryptographic keys, or other sensitive information held in memory, thereby compromising confidentiality for the affected host.

Affected systems include Microsoft Windows 10 versions 1607 through 22H2, Windows 11 versions 24H2, 25H2 and 26H1, and Windows Server releases 2012 through 2025, in both standard and Server Core configurations. All builds listed – x86, x64, and arm64 – are subject to the flaw.

The vulnerability has a medium CVSS score of 6.5; the EPSS score is below 1%, indicating a low likelihood of exploitation. It is not listed in the CISA KEV catalog. An attacker only needs network connectivity to the RDP service; no authentication is required to trigger the out‑of‑bounds read. The attack vector is inferred to be remote over a network connection to the RDP port.