An out‑of‑bounds read in the Azure Attestation service and Device Health Attestation Service could be triggered by an unauthenticated remote actor. The flaw allows the attacker to read memory contents that should be private, leading to disclosure of potentially sensitive configuration or state information. The vulnerability is classified as an out‑of‑bounds read (CWE‑125) and, because the data can be recovered over the network, it could expose credentials or other secrets to an adversary.

The issue affects Microsoft Windows Server 2019, Windows Server 2022 and Windows Server 2025, including Server Core installations. No additional sub‑version or build granularity is supplied in the advisory, so any installation of the affected product families should be considered vulnerable until a fix is applied.

The CVSS vector assigns a score of 7.5, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is triggered by unauthenticated network traffic, the attack surface is open to any host that can reach the attestation services. An attacker could read memory over the wire, but no code execution or privilege escalation is described, so the risk is primarily information disclosure.