The flaw is located within the Windows Client Side Caching driver (csc.sys) and allows a local attacker with valid Windows logon credentials to read sensitive information that should not be exposed. The vulnerability manifests as a buffer or integer overflow that leaks data, resulting in unauthorized disclosure of potentially confidential content. No mechanism for remote code execution or privilege escalation is described in the advisory.

This weakness is present across a wide range of Microsoft Windows products. It includes Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and all Windows Server releases from 2012 through 2025, including Server Core installations. The Microsoft security update guide cites csc.sys as the affected driver component.

The conditions for exploitation are local access and legitimate user privileges. An attacker can trigger the overflow to read protected data but cannot gain code execution. The CVSS score of 8.8 marks it as high severity, though the EPSS score is currently unavailable and it is not listed in the CISA KEV catalog. Consequently, while the attack vector is constrained to local systems, the potential impact on confidentiality is significant.