A buffer over-read in the Windows CD-ROM driver allows an authorized local attacker to read data from memory that should not be accessible. The vulnerability originates from insufficient bounds checking when processing read requests, and is classified as CWE-126. Exploitation can lead to exposure of sensitive information on the local system, compromising confidentiality but not necessarily integrity or availability.

The flaw affects multiple Microsoft Windows releases, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, as well as 23H2 and 26H1; and a range of Windows Server editions from 2012 through 2025, covering both standard and core installations. Both x86 and x64 architectures are impacted, with certain Windows 11 builds also involving ARM64 platforms.

The CVSS score of 5.5 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting limited public exploitation data. Attackers must be authorized on the local machine, so the primary risk is to systems where local users have sufficient privileges. While the vulnerability does not provide remote or privilege escalation vectors, the ability to read arbitrary memory can still enable data disclosure or further local attacks if the attacker has additional capabilities.