The Windows Device Association Service contains an out‑of‑bounds read flaw (CWE‑125). When processed with the proper context, a local user with enough privileges can cause the service to read memory beyond its bounds, allowing disclosure of sensitive data stored on the system. The weakness results in exposure of confidential information, but does not provide code execution or denial of service.

Microsoft Windows 11, versions 23H2, 24H2, 25H2, 26H2 and 26H1, and Microsoft Windows Server 2025 including Server Core installations are affected. The vulnerability applies to both ARM64 and x64 builds for Windows 11 and applies to the Windows Server 2025 release.

The CVSS score of 5.5 reflects a moderate severity reflecting the local information disclosure impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local; an attacker must first have authorized local access to the affected system to trigger the out‑of‑bounds read. Because the weakness is limited to local privilege escalation, the overall risk is moderate but remains significant for systems that host sensitive data or operate in restricted environments.