A numeric truncation error in Microsoft’s Internet Storage Name Service permits an authorized local user to read more data than intended, resulting in leakage of sensitive information. The flaw is classified as CWE‑197 and leads to information disclosure that could be leveraged for further compromise.

The vulnerability affects Microsoft Windows 10 builds 1607, 1809, 21H2, and 22H2; Windows 11 builds 23H2, 24H2, 25H2, and 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core installations.

With a CVSS score of 5.5 the flaw is considered medium severity. No EPSS score is reported and the issue is not listed in the CISA KEV catalog, indicating no publicly documented exploits to date. Attack requires local or authenticated access; an attacker who can log onto the system can exploit the truncation error to read disallowed data, potentially enabling further attacks if privileged information is exposed.