The vulnerability is an out‑of‑bounds read within the Windows Aggregated Data Platform Service that permits an authorized local attacker to read data outside the intended bounds of a memory buffer, potentially exposing sensitive information. The weakness is a classic out‑of‑bounds read error, classified as CWE‑125.

Affected systems are Microsoft Windows 11 releases, specifically the 24H2, 25H2, 26H2 and 26H1 editions for ARM64 or x64 architectures as listed by the Common Platform Enumeration entries.

The CVSS score of 5.5 indicates moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The exploit requires local privilege; an authenticated user can trigger the out‑of‑bounds read to disclose memory contents. There is no indication of a remote exploitation path or privilege escalation; thus the risk is contained to environments where privileged users have access to the service.