This vulnerability is an out-of-bounds read in the Windows Error Reporting component that allows an authorized local attacker to disclose memory contents or other local data. The exposed data may include sensitive configuration or user information that could be leveraged for further attacks. The flaw is a classic CWE-125 buffer over‑read and does not permit arbitrary code execution or wide system compromise.

Affected versions include Windows 10 1607, 1809, 21H2, and 22H2; Windows 11 23H2, 24H2, 25H2, 26H2, and 26H1; and multiple Windows Server releases such as 2012, 2012 R2, 2016, 2019, 2022, and 2025.

The CVSS score of 5.5 indicates moderate risk, and the vulnerability is local only, with no network exploitation path. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw requires an attacker to be authenticated or otherwise authorized on the system, it does not pose a remote threat but can be used by a local adversary to learn sensitive information that may aid in credential theft or privilege escalation.