The vulnerability is an out‑of‑bounds read in Microsoft Windows Media Foundation that permits a local attacker to read memory beyond the intended buffer, potentially disclosing sensitive information. This weakness is classified as CWE‑125 and can lead to local information disclosure. The impact is the unauthorized exposure of system or user data from memory that should not be accessible.

Affected are various Microsoft Windows 10 releases (1607, 1809, 21H2, 22H2), Windows 11 releases (23H2, 24H2, 25H2, 26H2, 26H1), and Windows Server editions from 2012 through 2025. Both x86, x64, and ARM64 platforms are impacted according to the listed CPEs.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score is not available, suggesting no current exploitation data. The vulnerability is not listed in the CISA KEV catalog. Attack vector is local, requiring an unauthorized user with access to the machine. Given the absence of a public exploit and the moderate score, the risk is considered moderate for environments where the susceptible versions are still in use.