An out‑of‑bounds read in the Windows NTFS file system can leak local data to an attacker who has authorized access, compromising confidentiality. The vulnerability is classified as a moderate severity issue with a CVSS score of 5.5, indicating that while the impact is significant, it requires local privilege to exploit.

Affected products include multiple Microsoft Windows releases: Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; and Windows Server editions 2012, 2012 R2 (including Server Core installations), 2016, 2019, 2022, and 2025 (including Server Core installations).

The CVSS score of 5.5 reflects a moderate risk, but the exploitability is limited to local attackers with sufficient permissions. No public EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog, suggesting a lower likelihood of widespread exploitation in the wild. The attack likely proceeds by triggering an out‑of‑bounds read within the NTFS module, which can disclose sensitive file system or memory content if the attacker can execute code or influence the NTFS handling workflow.