An out-of-bounds read in the Windows AppX Deployment Service allows a local authorized attacker to read sensitive data from memory, resulting in confidential information disclosure. The vulnerability is a buffer over‑read (CWE‑125) and does not provide control over code execution or denial of service. It exposes data that the attacker may already have access to locally, but the disclosure could provide additional secrets stored in the service’s memory.

Windows 10 versions 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server 2019, Server 2022, Server 2025, including their Server Core installations. Certain ARM64 builds of Windows 11 are also impacted. Users running any of these operating systems without the respective update are at risk.

The CVSS score of 5.5 indicates a moderate impact level. Exploitation requires a local user with sufficient privileges to start or interact with the AppX Deployment Service, meaning the threat is limited to authenticated attackers on the same machine. The EPSS score is less than 1 %, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not widely abused. Nevertheless, the confidentiality risk warrants timely mitigation through application of the patch once it becomes available.