An out‑of‑bounds read was discovered in the Microsoft Windows Search Component. An attacker with local privileges can trigger the vulnerability and access sensitive data stored in memory. The flaw allows the disclosure of confidential information, exposing the system to confidentiality compromise. The weakness is an out‑of‑bounds read, mapped to CWE-125.

Vulnerable products include Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, build 23H2 (arm64), 26H1 (x64); and Windows Server 2012 through 2025, including Server Core installations. The vulnerability was identified in both 32‑bit and 64‑bit builds, and it affects all x86, x64, and arm64 variants listed.

According to Microsoft, the CVSS score is 5.5, indicating moderate risk. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not been observed. Because the attack requires local, authorized access, the exploitation window is limited to users already present on the machine. An attacker would need to invoke the vulnerable component or trigger the read via a crafted file or query . Despite the local nature, the confidentiality breach can impact sensitive corporate data when the privileged user is abused.