An out‑of‑bounds read in the Windows IP Over USB Service can be triggered by an authorized local attacker, allowing disclosure of sensitive data from memory. The flaw does not permit code execution or denial of service, but it gives the attacker direct access to memory contents they would otherwise be able to read only through normal API channels.

Microsoft Windows 10 21H2, 22H2; Microsoft Windows 11 23H2, 24H2, 25H2, 26H1, 26H2; and Microsoft Windows Server 2022, 2025 (both full and Server Core installations). The vulnerability is present in the listed versions of the IP over USB service used by those operating systems.

The CVSS score of 5.5 indicates a moderate risk, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, suggesting no known active exploitation. The likely attack vector is local; an attacker with authorized access on the affected system can invoke the IP over USB Service and perform the out‑of‑bounds read, enabling disclosure of potentially confidential data. The impact is limited to the local environment and does not provide remote access or escalation.