An out‑of‑bounds read flaw exists in the Windows Win32 Kernel Subsystem. When triggered by a locally authorized attacker, the flaw allows the attacker to read memory beyond the bounds of a buffer, exposing sensitive data that resides elsewhere in the process or kernel memory. This weakness is classified as CWE‑125 and can lead to the disclosure of confidential information, configuration details, or cryptographic material to the attacker, thereby compromising data confidentiality on the affected system.

A wide range of Microsoft Windows operating systems are affected. This includes Windows 10 releases from version 1607 to 22H2, Windows 11 releases from 23H2 through 26H2 (and the 26H1 variant), all major Windows Server editions from 2012 through 2025 (including Server Core installations), and the ARM64‑based Windows 11 26H2 build as well. All of these editions are listed as affected by Microsoft in the official advisory.

The CVSS score of 5.5 indicates a moderate level of risk. EPSS data is not currently available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely known exploitation yet. The vulnerability requires local, authorized access; an attacker must already have a user context on the target machine to successfully trigger the out‑of‑bounds read. While remote exploitation is not possible, a local user with elevated privileges (e.g., administrator) can leverage this flaw to read arbitrary memory, potentially exposing sensitive data.