The vulnerability is an out‑of‑bounds read in the Windows GDI subsystem that can be triggered by an unauthorized attacker, allowing the disclosure of data accessible over the network. The flaw results in a loss of confidentiality and is classified as CWE‑125.

Affected Windows operating systems include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 (arm64), and 26H1; and Windows Server releases 2012, 2016, 2019, 2022, and 2025. All variants, including Server Core and x86/x64/arm64 builds, are impacted per Microsoft advisory.

The CVSS score of 6.5 indicates moderate severity, and no EPSS score is currently available, so the exploit probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, implying no known active exploits at the time of publication. The likely attack vector is remote, requiring network access to the target system and the crafting of a malicious GDI request. The risk, while moderate, is non‑negligible in environments where GDI functions are exposed.