A buffer over‑read in the Windows Remote Network Driver Interface Specification (RNDIS) subsystem permits an unauthorized attacker to read memory from the machine. The flaw is a classic buffer over‑read (CWE‑126) that can reveal sensitive data such as credentials or configuration information. The vulnerability is presented via the rndismp6.sys driver and requires an attacker with physical access to the system in order to trigger the over‑read.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including Server Core editions). All affected builds use the rndismp6.sys driver and are enumerated in the Microsoft advisory.

The CVSS score of 4.6 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely known exploits at this time. The attack requires physical access to the machine and the presence of a vulnerable RNDIS driver. While the exploit vector is limited, the disclosure of sensitive memory contents could aid a later credential‑stealing or privilege‑elevation attack. Organizations should evaluate whether their environment uses RNDIS devices and consider the risk accordingly.