The vulnerability is an out‑of‑bounds read in the Microsoft Bluetooth driver that allows an authorized local attacker to read memory that the driver should not disclose, leading to local information disclosure. It is a classic out‑of‑bounds read (CWE‑125) and can expose sensitive data stored on the device.

Multiple Microsoft Windows releases are affected: Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26 H1, and the 23H2 duplicate; Windows Server 2016, 2019, 2022, 2025 including Server Core installations. Both x86 and x64 are impacted and some Windows 11 ARM64 versions are also affected.

The base CVSS score of 5.5 indicates moderate severity. The EPSS score is less than 1 %, indicating a very low but non‑zero likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Attackers require local authorization with sufficient privileges to load or interact with the Bluetooth driver, so the threat is primarily local. Successful exploitation would allow the attacker to read confidential memory without remote access.