Out-of-bounds read in the HID Parser Library allows an authorized attacker to read memory beyond intended bounds, potentially exposing sensitive data. This flaw is a classic example of CWE-125, meaning that data outside the intended object reference can be exposed to a local user. The vendor’s description indicates that information can be disclosed locally, implying that an attacker must already have a foothold or legitimate privilege to trigger the vulnerability.

Affected products include several Windows 10 releases (1809, 21H2, 22H2), Windows 11 releases (23H2, 24H2, 25H2, 26H2, 23H2 again, 26H1), as well as Windows Server 2019, Server 2022, and Server 2025, across both core installations and normal instances. The specific architecture variants noted are x86, x64, arm64 and arm64-based systems.

The CVSS score of 5.5 denotes a medium impact level, while the EPSS score is not published, so exploitation probability cannot be quantified from public data. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread use of exploit code is publicly known. Attackers would likely need local or edge device privileges to manipulate HID input settings and read memory out of bounds, thus the attack vector is local and requires an authorized or compromised user context.