The vulnerability is a time‑of‑check to time‑of‑use race condition in the Win32 kernel subsystem, allowing an attacker with local authorization to read protected memory data and potentially disclose confidential information. The flaw can lead to partial leakage of system memory or application data, compromising confidentiality but not directly enabling privilege escalation or denial‑of‑service.

Affected Microsoft Windows operating systems include Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1), and Windows Server 2012 through 2025, encompassing both x86, x64, and ARM64 builds.

The CVSS score of 5.5 indicates moderate risk, but the flaw requires local authorization and offers no remote exploitation path. The EPSS score is not available, so the current likelihood of exploitation cannot be precisely quantified, and the vulnerability is not listed in the CISA KEV catalog. Given those factors, the risk is medium, with potential impact on confidentiality for users with sufficient local access.