The vulnerability is an out-of-bounds read in the Desktop Window Manager component that may allow an attacker with local privileges to read memory beyond intended boundaries. This flaw can lead to the disclosure of sensitive information present on the local system, such as user data, process memory, or configuration settings, without requiring elevated privileges. The weakness is classified as CWE-125, indicating unchecked read of memory outside a buffer’s limits.

Affected systems include Microsoft Windows 10 versions 1809, 21H2 and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1; and Microsoft Windows Server 2019, 2022 and 2025, including Server Core installations.

The CVSS score of 4.7 reflects moderate severity; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, requiring an authorized attacker with user or administrator privileges to trigger the out-of-bounds read. While the flaw permits information disclosure, it does not provide remote execution or broader compromise. Overall risk is moderate, with exploitation feasible primarily in environments where local privileges are available.