An authorized local attacker can exploit a type‑confusion flaw in Windows Secure Kernel Mode, enabling the disclosure of privileged kernel data. The vulnerability, classified as CWE‑843, allows the attacker to read kernel memory that should be protected, potentially exposing configuration, credential, or other sensitive information.

Microsoft Windows 10 releases 1809, 21H2, and 22H2; Microsoft Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1; and Microsoft Windows Server 2019 (standard and Server Core), Windows Server 2022, and Windows Server 2025 (standard and Server Core). These versions span both x86 and x64 architectures, including ARM64 for certain Windows 11 builds.

With a CVSS score of 5.5, the vulnerability presents a moderate risk profile. Exploitation requires local authorized privileges; the EPSS score is not available, and the flaw is not listed in the CISA KEV catalog. In practice, a compromised local user or service could read kernel data, supporting lateral movement or privilege escalation but not remote code execution.