An out‑of‑bounds read exists in the Windows Fast FAT file system driver, allowing an unauthenticated local attacker to read memory beyond the intended buffer boundaries and disclose sensitive data stored on the system. This flaw falls under the CWE-125 "Out‑of‑Bounds Read" weakness, which can lead to exposure of confidential configuration values, possibly passwords, or other sensitive information that resides in memory at the time of the read. The vulnerability is strictly local and does not require network access or special privileges beyond local user rights.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 arm64, 26H1, 26H2 arm64; Windows Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 2022, Server 2025, including their core installations. All versions listed are affected by this out‑of‑bounds read in the Fast FAT driver.

The CVSS score of 5.5 indicates a moderate severity for this information disclosure. No EPSS score is available, so we cannot quantify the current exploitation probability, but the flaw requires local execution and does not appear to be a remotely exploitable flaw. Because the CVE is not listed in CISA's KEV catalog, there is no evidence of active exploitation at the time of analysis. Attack vectors are inferred to be local users or processes that can access the drive on which the Fast FAT file system is mounted, allowing them to trigger the buffer overread and read the disclosed data.