The CVE describes a buffer over‑read in the Windows Common Log File System (CLFS) driver that allows an attacker with local code execution privileges to read memory locations beyond the intended buffer boundaries. The exposed data may include sensitive system or user information, leading to possible compromise of confidentiality. This is a classic CWE‑126 (Buffer Over‑read) flaw compounded by CWE‑497 (Security Control Issues).

Affected products include multiple Windows client and server releases: Windows 10 versions 1607, 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Windows Server editions 2012 (both core and full), 2012 R2, 2016, 2019, 2022, and 2025 with both core and full installations. The list spans x86, x64, and ARM64 architectures as represented by the corresponding CPE identifiers.

The CVSS base score is 5.5, indicating a moderate impact when an attacker can read local data. The EPSS score is not available, so the current probability of exploitation is unknown but likely low to moderate due to the local‑only nature of the vulnerability. The CVE is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is local, requiring an attacker to run code on the affected system with sufficient privileges to trigger the buffer over‑read and obtain sensitive data.