This vulnerability is an out‑of‑bounds read in the Windows Key Storage Provider that lets a local attacker retrieve arbitrary data from memory. The flaw can expose sensitive information but does not provide code execution or elevate privileges; the impact is limited to information disclosure. The weakness aligns with CWE‑125, a buffer overread condition.

Affected systems include Microsoft Windows 10 releases 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server releases 2012 R2, 2016, 2019, 2022, and 2025, across both full and Server Core installations.

The CVSS score of 4.7 places the vulnerability in the medium severity range. The EPSS score is not available, indicating no current exploitation data, and it is not listed in the CISA KEV catalog. Since the flaw requires a local user with authorized access to invoke the Key Storage Provider API, exploitation hinges on user privileges and local access controls, thereby limiting the broad attack surface.