An out‑of‑bounds read vulnerability in the Windows SMB Client permits an attacker with local authorization to read arbitrary memory, potentially disclosing sensitive information. The flaw is classified as CWE‑125, an out‑of‑bounds read weakness. Because the defect is local in scope, it results in information disclosure without enabling remote code execution or denial of service.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, both full and Server Core editions. All these releases use the SMB Client component and are therefore vulnerable.

The CVSS score of 5.5 indicates a moderate risk, and the EPSS score is currently unavailable while the vulnerability is not listed in CISA’s KEV catalog, implying no widespread exploitation has been publicly observed. Attackers must possess local access before exploiting the out‑of‑bounds read flaw, limiting the attack surface compared to a network‑exposed vulnerability. An attacker who gains local authorization, such as through a privileged account or malicious application, can read sensitive memory blocks and exfiltrate confidential data from the target machine.