The Push Message Routing Service contains an out‑of‑bounds read that allows an authorized local attacker to read memory locations beyond the intended bounds, exposing sensitive data such as credentials or configuration settings. The weakness is classified as CWE-125 (Out‑of‑Bounds Read) and CWE-191 (Integer Underflow).

Affected Windows operating systems include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server releases 2016, 2019, 2022, and 2025, in both full and core installations.

The vulnerability has a CVSS score of 5.5, indicating medium severity, and has no publicly available EPSS score or KEV classification. Exploitation requires local privilege; an attacker must be authorized on the system to engage the Push Message Routing Service and trigger the out‑of‑bounds read. The impact is limited to confidentiality compromise for the local user and does not provide remote code execution or denial of service.