The vulnerability is a CWE-908 uninitialized resource in the Windows Netlogon component that allows an attacker with authorized local access to read sensitive information, resulting in the potential disclosure of confidential data within the affected system.

Affected systems include Microsoft Windows 10 variants (versions 1607, 1809, 21H2, 22H2), Windows 11 variants (23H2 to 26H2 versions), as well as a range of Windows Server editions from 2012 to 2025, including both standard installations and server‑core variants.

With a CVSS score of 5.5 indicating moderate severity, and an EPSS of <1% showing a low but non‑zero likelihood of exploitation, the vulnerability is not widely referenced or listed in CISA KEV catalog. The attack vector is local, requiring an authorized user with access to the target machine, so the primary risk is confined to individuals with legitimate system access.