The vulnerability is an out-of-bounds read in the HID Parser Library that can be exercised by an authorized local attacker. By reading memory beyond the bounds of a buffer, the attacker may disclose sensitive data stored near that buffer. The impact is local information disclosure with no known remote code execution or denial of service.

Microsoft Windows 10 1809, Windows 10 21H2, Windows 10 22H2, Windows 11 23H2, Windows 11 24H2, Windows 11 25H2, Windows 11 26H2, Windows 11 26H1, Windows Server 2019, Windows Server 2019 (Server Core), Windows Server 2022, Windows Server 2025, Windows Server 2025 (Server Core).

The CVSS base score of 5.5 indicates moderate severity. EPSS data is not available, but the vulnerability is not listed in CISA's KEV catalog, and it requires local authorization, limiting the potential for widespread exploitation. The likely attack vector is local; an attacker who has physical or local user access would need to trigger the out-of-bounds read to read privileged memory. Overall, the risk remains moderate due to the lack of remote exploitation paths and limited exploitation probability.