The vulnerability arises because Windows Print Spooler Components use uninitialized resources, permitting an authorized local attacker to read sensitive data. This weakness is a CWE-908 memory management flaw that allows disclosure of system information on the host.

The vulnerability affects a broad swath of Microsoft Windows releases, including Windows 10 versions 1607 through 22H2, Windows 11 versions 23H2 through 26H2, and Windows Server editions from Server 2012 to Server 2025. All major architectures, such as x86, x64, arm64, and server-core installations, are listed by the CNA and reflected in the associated CPE entries.

The CVSS score of 5.5 places the issue in the medium severity range and no EPSS score is available, so exact exploitation likelihood cannot be quantified. The vulnerability is not listed in the CISA KEV catalog, indicating no widespread exploitation has been observed. The attack vector is local, requiring an authenticated attacker with sufficient rights to interact with the Print Spooler service, thereby limiting risk to systems with strict privilege controls.