The flaw is an out‑of‑bounds read in Azure Attestation and Device Health Attestation services that allows an attacker with network access to read internal data. The vulnerability is classified as an information disclosure weakness (CWE‑125), permitting exposure of confidential memory contents.

Affected systems are Microsoft Windows Server 2019 and Server Core, Windows Server 2022, Windows Server 2025 and Server Core. No specific patch version is provided, so all listed product lines must be reviewed for the flaw.

The CVSS score of 7.5 indicates a high severity for potential exploitation. No EPSS data is available and the vulnerability is not yet in the CISA KEV list, but it can be leveraged by an attacker who can reach the Azure Attestation endpoints over a network. The attacker requires network connectivity to the affected services; no local privilege escalation or remote code execution is reported.