This vulnerability is a use‑after‑free flaw in the Windows Network Connection Broker that can be exploited by an attacker who already has local authorization. The flaw allows the attacker to read memory that should have been freed, exposing sensitive data that would normally be protected by the operating system. Because the vulnerability is limited to the local context, it results in an information‑disclosure attack rather than remote code execution.

Affected Microsoft products include Windows 10 build 1607, 1809, 21H2 and 22H2; Windows 11 build 23H2, 24H2, 25H2 and 26H1; and Windows Server 2016, 2019, 2022 and 2025, including their Server Core installations.

The CVSS base score is 5.5, indicating moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited. The likely attack vector is local, requiring that the attacker already possess authorized access to the target machine. If successful, the attacker can read confidential information from the victim’s system, but the impact remains confined to the compromised host and does not provide a remote execution path.