Buffer over-read in the Servicing Stack Updates component allows an authorized local attacker to read past the intended buffer boundaries and expose sensitive memory contents, such as configuration data or credentials. The weakness, classified as CWE-126, can lead to the disclosure of confidential system or application information, depending on what resides in the leaked memory region. The primary impact is the exposure of sensitive data to a local user who has the privileges required to load the servicing stack.

Microsoft Windows 10 versions 1809, 21H2, and 22H2, Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1, as well as Windows Server 2019, Windows Server 2022, and Windows Server 2025—including Server Core installations—are affected. The risk is present across x86, x64, and ARM64 platforms as indicated by the referenced CPE entries.

The CVSS base score of 5.5 indicates moderate severity, and the vulnerability is limited to local authorized users, requiring them to execute code with sufficient privilege to trigger the buffer over-read. EPSS data is not available, making current exploitation probability unclear, and the vulnerability is not presently listed in the CISA KEV catalog. Exploitation would likely involve running code on the target system with user or higher privileges, providing access to memory that may contain sensitive data.