An out‑of‑bounds read in the HID Parser Library allows a local, authorized attacker to read memory beyond the intended bounds and disclose sensitive information. This flaw (CWE‑125) can compromise confidentiality for a privileged user without affecting integrity or availability.

The vulnerability affects Microsoft Windows 10 (versions 1809, 21H2, and 22H2), Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H2, and 26H1), and Microsoft Windows Server 2019, 2022, and 2025, including Server‑Core installations.

The CVSS score of 5.5 indicates moderate severity, the EPSS score is unavailable, and Microsoft does not list it in the KEV catalog, suggesting no widespread active exploitation. The likely attack vector is local; an attacker must be legitimately authenticated and able to interact with HID parsing, typically within a logged‑on Windows session, to trigger the read and expose confidential data.