Incorrect authorization in Windows kernel‑mode drivers allows an attacker with legitimate local user rights to read sensitive data that should be protected. The flaw is a classic insufficient authorization issue and could lead to leakage of configuration files, memory contents, or other protected data, compromising confidentiality within the affected system. This vulnerability does not provide remote code execution or privilege escalation but is significant when the victim has local access, exposing the system to insider threats or compromised malware.

Affected are Microsoft Windows 11 24H2, 25H2, 26H2, 26H1 (including ARM64 and x64 variants) and Windows Server 2025, Server Core installations. The vulnerability exists in kernel‑mode drivers shipped with these releases, as enumerated by the Microsoft Security Response Center.

The CVSS score of 5.5 indicates moderate severity. EPSS is not available, and the flaw is not listed in the CISA KEV catalog, suggesting no widespread exploitation yet. The attack vector is local: an attacker must authenticate or be a user with sufficient privileges on the machine. The exploitation requires no network connectivity and is limited to the host, so risk is contained to environments where privileged local users exist.