The vulnerability is located in the Win32 Kernel Subsystem of Windows. It allows an attacker who already has local authorized control over a system to read protected kernel data, revealing information that should be confidential. This is a kernel‑level information disclosure and is classified as CWE‑497.

Affected products include Microsoft Windows 10 (Versions 1607, 1809, 21H2, 22H2), Microsoft Windows 11 (Versions 23H2, 24H2, 25H2, 26H2 and the 23H2–26H1 arm64/x64 builds), and Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 editions, including their Server Core installations.

The CVSS score of 4.7 indicates moderate risk. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation is not yet reported. Attackers must already have authorized local access; they can then read kernel‑protected data. Because the flaw does not provide code execution or privilege escalation, the threat mainly consists of leaking confidential system information, which could aid further attacks if coupled with other weaknesses.