Uninitialized resource usage within the Windows RPC Runtime (CWE‑908) allows an unauthenticated attacker to obtain sensitive information over the network. This information disclosure can expose internal memory contents or configuration data during RPC calls. The likely attack vector is a remote network attacker sending crafted RPC requests.

The vulnerability affects Microsoft Windows 10 releases 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2012 through 2025. It applies to both x86 and x64 desktop editions and to arm64‑based Windows 11 and Windows devices. All affected versions run the standard RPC Runtime that processes incoming requests from external hosts.

The CVSS score of 6.5 indicates medium severity, and the EPSS score is <1%, indicating a very low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers could potentially execute the vulnerability remotely by sending specially crafted RPC requests, resulting in confidential data leakage. Prompt remediation is required to mitigate the risk of exposure.