The vulnerability is an out-of-bounds read in the Windows Universal Disk Format File System Driver (UDFS), which an attacker with local, authorized user privileges can exploit to read memory beyond intended bounds, potentially exposing sensitive data stored on the disk. This flaw results in confidential information disclosure and is categorized as CWE‑497, indicating an out-of-bounds read weakness. There is no evidence of remote code execution or denial‑of‑service impacts.

Affected systems include various editions of Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2), Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1), and multiple Windows Server releases from 2012 through 2025, both standard and Server Core installations. These environments rely on the UDFS driver for reading ISO image files and other media types, making them susceptible when the driver contains the vulnerable code.

The CVSS score of 5.5 indicates a moderate severity, and the EPSS score is not available, so the likelihood of exploitation in the wild cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, but it requires a local, authorized user to trigger the out‑of‑bounds read. Attackers would need privileged local access or a compromised user account, so the risk is confined to environments where users have sufficient access rights to mount the UDFS file system.