Out-of-bounds read in Windows Hello (CWE-125) causes local information disclosure. The flaw permits an authorized attacker, who already has local access, to read memory beyond intended bounds. This vulnerability does not grant broader system compromise but can expose confidential information to the attacker.

Microsoft Windows 10 versions 21H2 and 22H2, and Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1 on x86, x64, arm64, and arm64 systems are vulnerable. The flaw affects the Windows Hello component across these releases.

With a CVSS score of 5.5, the vulnerability is rated medium severity. The EPSS score of < 1% indicates a very low probability of exploitation, and there are currently no known public exploits. Because an attacker must already have authorized local access to exploit this out‑of‑bounds read in Windows Hello, remote exploitation is not possible. The flaw is not listed in CISA's KEV catalog, so no confirmed exploitation has been reported.