Out-of-bounds read occurs within the Windows Win32 Kernel Subsystem, allowing an attacker who has local authorization on the machine to read memory regions that should be protected. The vulnerability falls under CWE‑125 and results in a confidentiality compromise, exposing potentially sensitive data while operating under the victim’s user context.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, and 26H1; Windows Server 2012, Server 2012 R2, 2016, 2019, 2022, and 2025 including their Server Core installations.

The CVSS score of 5.5 indicates moderate severity; EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, requiring the attacker to already have authorized access to the system. With no public exploit known, the risk remains moderate, but the existence of the flaw still warrants timely remediation.