The vulnerability stems from uninitialized resource handling within the Windows Win32K subsystem. This flaw allows an attacker who is already authenticated and has local administrative or privileged user rights to read memory that should be private. The affected code can be triggered through normal usage of the subsystem without special conditions. Consequently, sensitive data stored in memory can be exposed, creating a local information disclosure risk that could reveal credentials, encryption keys, or other confidential data.

Microsoft Windows operating systems are affected, including Windows 10 releases 1607, 1809, 21H2, and 22H2, as well as Windows 11 releases 23H2, 24H2, 25H2, 26H2 and 26H1, and all major Windows Server editions from 2012 through 2025. All processor families that run these releases are susceptible. The specific CPEs list numerous architectures, ensuring a wide coverage across x86, x64, ARM64, etc.

The CVSS score of 5.5 indicates a medium impact, but the vulnerability requires local privilege and is not widely exploitable over a network. EPSS data is not available, and the flaw is not listed in CISA's KEV catalog, suggesting no publicly known exploits. An authorized local user could leverage the flaw to read disallowed data, potentially affecting confidentiality of system‑secrets and personal information. Because the exploit path is simple once the attacker has local access, organizations should treat this as a moderate risk until a patch is deployed.