A buffer over‑read flaw in the Desktop Window Manager allows an authorized local attacker to read memory contents that should be protected, leading to disclosure of sensitive data. This weakness is classified as CWE‑126 and can expose information that may be confidential or proprietary. The attack does not provide code execution or privilege escalation, but it can reveal valuable information such as passwords, encryption keys, or other secret data stored in memory.

Affected Windows operating systems include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2 and the ARM64 26H2 build; as well as Windows Server editions 2016, 2019, 2022, and 2025, including their Server Core installations. No additional affected versions are listed in the vendor advisory.

The CVSS v3 score of 5.5 reflects a moderate severity, and the exploit probability is currently unknown because the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, which indicates no publicly available exploits at this time. An attacker must be authenticated on the target machine and cannot use the flaw remotely; the risk is thus limited to local privilege holders or local administrators. Nonetheless, the potential for confidential data leakage warrants action.