The vulnerability is an out‑of‑bounds read in the Windows Cryptographic Services that allows an authenticated local user to read protected memory and expose sensitive information. This can provide attackers with data that may aid further compromise, such as cryptographic keys or other secrets.

Microsoft Windows 11 build 24H2, 25H2, 26H2, and 26H1, as well as Windows Server 2025 (including Server Core installations) are impacted, primarily on ARM64 platforms. The flaw is detailed in the Microsoft Security Response Center advisory for CVE‑2026‑69919.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score is not available while the issue is not listed in the CISA KEV catalog, suggesting a modest likelihood of exploitation. However, the flaw can be triggered by any authorized local attacker, so the risk is significant for systems that lack strict local privilege controls. Mitigation involves applying the vendor patch and enforcing least privilege to reduce exposure.