The disclosed vulnerability resides in Windows HTTP.sys and allows an attacker with authorized local access to read sensitive system information such as configuration data or logs that should remain private. As a result, confidentiality of local system state is compromised, potentially enabling further attacks within the same environment. This weakness is characterized as CWE‑497, reflecting improper privilege checks that grant access to protected data.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, including ARM64 and x64 variants; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, both full installations and Server Core variants. These versions match the CNA affected‑version data and the listed cpe identifiers.

The CVSS score of 5.5 indicates medium severity, while the EPSS score of < 1 % suggests a very low exploitation likelihood. Because the vulnerability requires local authorized privileges, the attack vector is local and the scope is limited to the compromised machine. The vulnerability is not included in the CISA KEV catalog. Consequently, the overall risk remains moderate, and the presence of a patch allows for straightforward remediation.