This vulnerability arises from an out‑of‑bounds read in the Windows HTTP.sys driver. An authorized local attacker can trigger the flaw and read memory beyond the intended buffer, disclosing sensitive data such as credentials or configuration information. The weakness corresponds to CWE‑125 and does not provide remote code execution or system compromise. The impact is limited to the confidential data that resides in memory at the time of the read.

Microsoft Windows 10 devices running versions 1607, 1809, 21H2, and 22H2, Windows 11 devices running 23H2, 24H2, 25H2, 26H2, 23H2, and 26H1, and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, including server‑core installations, are affected. The flaw is present in the HTTP.sys component bundled with each of these operating systems.

The CVSS score of 5.5 indicates moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a legitimate local account with sufficient privileges to interact with HTTP.sys, making the attack vector local. Attackers can read sensitive data but cannot elevate privileges or remotely execute commands.