An out‑of‑bounds read during the Windows Update process allows a locally authorized attacker to read memory contents that are not intended for disclosure, resulting in a privacy breach. The flaw is identified as CWE‑125 and has a CVSS score of 5.5, indicating moderate severity.

Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, as well as the corresponding ARM64 builds; Windows 11 version 23H2 and 26H1; and Windows Server 2025, including the Server Core installation. These products are listed on the Microsoft security advisory linked above.

The vulnerability can only be exercised locally by an attacker with authorized access to the affected system; it is not remotely exploitable. The EPSS score is not available, and the vulnerability is not yet listed in the CISA KEV catalog. Given the CVSS score of 5.5 and the local nature of the attack, the threat is moderate but still warrants attention, especially in environments where sensitive data resides on the affected machines.