An out‑of‑bounds read in the Function Discovery Service component, fdwsd.dll, can leak data to an unauthorized attacker, resulting in information disclosure. The flaw leads to accidental exposure of sensitive memory contents without requiring authentication, raising confidentiality risks. This weakness matches CWE‑125, Out‑of‑Bounds Read.

The vulnerability affects Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2, Windows 11 releases 23H2, 24H2, 25H2, 26H2, the 23H2 and 26H1 variants, as well as Windows Server 2012 (both standard and Core), Windows Server 2012 R2, Windows Server 2016, 2019, 2022 and 2025 editions, including both standard and Core installations.

The CVSS score of 7.5 indicates a high‑severity vulnerability. The EPSS score is not available, so the current likelihood of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network‑based exploitation, where an adversary connects to the Function Discovery Service over a local or remote network and triggers the out‑of‑bounds read to retrieve disclosed data. Since the flaw does not require elevated privileges, any attacker with network access to the target system can attempt exploitation.