The vulnerability is a result of an uninitialized resource in the Windows Kernel that allows an authorized local user to read sensitive data that should not be exposed. This flaw does not grant remote code execution but can leak confidential information and potentially aid further attacks. The weakness is classified as CWE-497 and CWE-908, indicating improper initialization of kernel data structures is used for a security decision.

Vulnerable operating systems include Windows 10 versions 1607, 1809, 21H2, and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, and selected Windows Server releases: 2012, 2012 R2, 2016, 2019, 2022, and 2025. All builds noted in the provided CPE list are impacted, covering both x86 and x64 architectures as well as ARM64 for certain Windows 11 releases.

The CVSS score of 4.7 indicates moderate severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited evidence of exploitation in the wild. Likely attack vectors involve a local privileged user, as the description specifies an authorized attacker; therefore, the scope of disclosure is confined to the host and requires local access. No remote exploitation vector is documented.