The vulnerability arises from the use of an uninitialized resource within the Windows Win32 Kernel Subsystem. A local, authorized attacker can read data that has not been properly cleared, leading to unintended disclosure of sensitive information. The weakness is identified as CWE‑908.

Affected products include Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1), as well as Windows Server 2012 (full and Server Core), Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, and Windows Server 2025. The affected editions span both x86 and x64 architectures, and ARM64-based Windows 11 builds.

The CVSS score of 5.5 categorizes the vulnerability as moderate with regard to confidentiality impact. The EPSS score is not available, therefore the exploitation probability cannot be precisely quantified. The issue is not currently listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is local, requiring authorized access. An attacker would need to trigger the erroneous use of the uninitialized resource, which typically occurs during normal operation of system components that rely on the Win32K subsystem. The absence of a publicly documented exploitation method means the risk to unpatched systems remains moderate.