The vulnerability is an out-of-bounds read in the HID Parser Library, enabling an attacker with local authorization to read memory beyond intended limits and potentially disclose sensitive data stored on the system. This flaw is categorized as CWE-125, representing an uncontrolled memory read that can lead to information leakage.

Affected operating systems include Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server releases 2019, 2022, and 2025 (both generic and Server Core installations). The vulnerability applies to both x86, x64, and arm64 architectures as detailed by the CPE data.

The CVSS base score of 5.5 indicates a medium severity vulnerability. EPSS is not available and the issue is not listed in the CISA KEV catalog. The likely attack vector is local, requiring an authorized user to trigger the out-of-bounds read. Based on the description, it is inferred that the attacker must have local authorization to exploit the flaw; remote exploitation would not be possible without additional compromise. The consequence is that the attacker could read memory on the local system, potentially exposing privileged information, though the scope is limited to the local context.