An out‑of‑bounds read in the Windows Search Component can expose data that is not intended for public consumption. The flaw allows an attacker with local system access to read memory beyond the intended buffer boundary, revealing sensitive content. This is a classic instance of CWE‑125, which results in local information disclosure rather than remote code execution or denial of service.

The vulnerability impacts a wide range of Windows operating systems, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 (ARM64), and 26H1 (x64); and Windows Server 2012 through 2025, encompassing both standard and Server Core installations on x86, x64, and ARM64 architectures as listed in the advisory.

The CVSS base score of 5.5 places the vulnerability in the moderate severity range. EPSS is not available, and it is not listed in the CISA KEV catalog, indicating that large‑scale exploitation has not been observed. Because the flaw requires local attacker privileges, it is most relevant in environments where privileged users can execute code or where local files are accessible. Overall, the risk is moderate but warrants prompt remediation to prevent potential data leakage.