The vulnerability resides in the Windows Portable Device MTP driver and is caused by an out‑of‑bounds read. When an authorized local user accesses the driver, data stored beyond the intended buffer boundary can be read. This flaw does not lead to code execution or denial of service; it simply allows the attacker to read information from the local system environment that the driver or adjacent memory contains.

Affected products include multiple releases of Windows 10 (versions 1607, 1809, 21H2, and 22H2) and Windows 11 (versions 23H2, 24H2, 25H2, 26H2, and 26H1) on both x86, x64, and ARM64 architectures, as well as Windows Server 2012 through Windows Server 2025, including Core installations. Any of these operating systems that have the MTP driver installed may be impacted.

The CVSS score of 5.5 categorizes the vulnerability as moderate. No EPSS score is provided, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed exploitation to date. The susceptibility requires local, authorized access; there is no evidence of remote attack capabilities. Consequently, the threat remains limited to environments where a local user has sufficient privileges to interact with the MTP driver.