An out-of-bounds read in the Windows Human Interface Device (HID) Parser Library enables an attacker with local access rights to read memory contents outside the intended bounds, allowing disclosure of sensitive data. The vulnerability is classified as CWE-125 and can be exploited by an authorized user or a process running with elevated privileges, resulting in local information disclosure that compromises confidentiality.

Affected releases encompass multiple Windows operating systems, including Windows 10 Version 1809, Windows 10 Version 21H2 and 22H2, Windows 11 Versions 23H2, 24H2, 25H2, 26H2, and 26H1, as well as Windows Server 2019, Windows Server 2022, and Windows Server 2025, including their Server Core installations. Both x86/x64 and ARM64 variants are impacted, as indicated by the referenced CPE strings.

The CVSS score of 5.5 indicates a moderate impact, while the EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting limited current exploitation activity. Based on the description, the likely attack vector is local, requiring an attacker already possessing legitimate or elevated privileges on the target machine. An exploited out-of-bounds read would permit the attacker to read arbitrary memory, potentially exposing confidential information. The absence of widespread exploitation mitigates urgency, but environments with compromised local users remain at risk.