An out‑of‑bounds read occurs within the HID Parser Library, allowing a local user or process with sufficient privileges to read memory that should be protected. The flaw is a confidentiality breach; an attacker can gather sensitive data from the kernel or user space memory held by the library, but it does not provide a pathway to remote code execution or denial of service. The weakness is classified as CWE‑125, Out‑of‑Bounds Read.

Microsoft Windows 10 build 1809, 21H2, 22H2 and Windows 11 builds 23H2, 24H2, 25H2, 26H2, 23H2, 26H1 as well as Windows Server 2019, Windows Server 2022 and Windows Server 2025 across x86, x64, arm64 platforms. All affected editions contain the vulnerable HID Parser Library.

The CVSS score of 5.5 indicates a moderate severity. No EPSS score is supplied, so the likelihood of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. The flaw is local, requiring a user or process that can load the HID Parser Library; therefore an attacker must already have local access or be able to run code on the target system. Despite the moderate score, the potential to read arbitrary memory makes this a non‑negligible threat, especially in environments where sensitive data is held in memory accessible to the library.