The vulnerability is an out‑of‑bounds read in the Windows Win32 kernel subsystem. An attacker who is already authorized on the local system can trigger the flaw and read memory that it should not access, resulting in disclosure of sensitive data. This is a classic buffer overflow reading error (CWE‑125) combined with improper bounds checking (CWE‑20).

Affected systems include Microsoft Windows 10 (1607, 1809, 21H2, 22H2) and Windows 11 (23H2, 24H2, 25H2, 26H2, 26H1) desktops, as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025, and their Server Core installations. All mentioned versions run the Win32k subsystem that is impacted.

The CVSS score of 5.5 signifies moderate severity. EPSS is not available, so current exploit probability cannot be quantified, and the vulnerability is not listed in CISA KEV, indicating no known widespread exploitation. The attack requires local access and some privilege level to initiate the kernel call; therefore, the risk is confined to a local attacker who can already log on to the machine. Mitigating the risk relies on applying the vendor fix before it can be leveraged in any potential attack corridor.