An out‑of‑bounds read occurs within the Windows Win32 Kernel Subsystem, allowing an attacker with local user privileges to read protected memory. The vulnerability does not provide remote access, but it can expose sensitive data such as private files, credentials, or other information residing in system memory. The weakness is an instance of CWE‑125 and represents a moderate confidentiality risk.

Affected Microsoft Windows operating systems include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 (arm64), 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including all server core installations. All listed architectures (x86, x64, arm64) are impacted.

The CVSS score of 5.5 indicates moderate severity. The EPSS data is not available, so the exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, suggesting that publicly known exploitation has not yet been reported. The likely attack vector requires the attacker to be able to execute code on the target machine with local user privileges, a common scenario in compromised or social‑engineering contexts. Based on the description, it is inferred that local privilege is the most reasonable requirement to exploit the out‑of‑bounds read.