An out‑of‑bounds read flaw (CWE-125) in the HID Parser Library allows an authorized local attacker to read memory beyond the intended bounds of a memory buffer. This can expose arbitrary data residing in the process space, potentially leaking sensitive information such as passwords, cryptographic keys, or other secrets. The vulnerability does not provide code execution or escalated privileges; its impact is limited to the disclosure of local memory contents.

Affected systems include Microsoft Windows 10 releases 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server releases 2019, 2022, and 2025, including Server Core editions. All these versions run the HID Parser Library code that contains the vulnerable path.

The CVSS v3.1 score of 5.5 classifies the flaw as medium severity. The EPSS score is reported as less than 1 %, indicating a very low exploitation probability. The vulnerability is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation. Based on the description, the likely attack vector is a local authorized attacker with access to a HID device, such as a user who has logged in or physical access to the machine. An attacker can exploit the out‑of‑bounds read by interacting with a malicious or tampered HID device to retrieve sensitive local memory contents.