An out‑of‑bounds read in the Windows Volume Manager Extension Driver allows an authorized local user to gain higher privileges. By reading beyond the bounds of a buffer, the attacker can manipulate driver control data, resulting in a privilege‑escalation flaw identified as CWE‑125.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations. All listed builds are affected by the vulnerable driver.

The vulnerability carries a CVSS score of 7 and an EPSS score of < 1%, indicating moderate to high risk and a low probability of exploitation in the general population. It is a local privilege escalation that requires the attacker to be an authorized user on the target machine. By reading beyond the bounds of a buffer within the Volume Manager Extension Driver, an attacker can manipulate driver control data and ultimately elevate privileges to SYSTEM level, allowing full control over the system. The vulnerability is not listed in the CISA KEV catalog.