The vulnerability arises from an uninitialized resource in the Windows Win32 Kernel Subsystem, allowing an authorized local user to read sensitive data that should be protected. This results in a confidentiality breach confined to the local system, as the attacker does not gain code execution or network level access. The weakness is identified as CWE‑908.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Microsoft Windows Server 2012 through 2025, covering core installation variants. Administrators of any of these operating systems must verify their installed updates to determine whether the issue has been addressed.

The CVSS score of 5.5 indicates a moderate severity, reflecting the limited scope of the attack. Exploitation requires local, authorized access; the EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, reducing the likelihood of widespread, automated exploitation. Nevertheless, an attacker with local privileges can still access sensitive configuration data, so organizations should treat it as a moderate risk until patched.