The flaw is an out‑of‑bounds read in the Windows Device Association Service that can allow an attacker with sufficient authorization to read sensitive data from the service’s memory and transmit it over the network. This results in information disclosure, exposing potentially confidential data without tampering with the system or gaining execution privileges. The weakness is identified as CWE‑125.

Affected products include multiple Windows client and server releases: Windows 10 version 1607, 1809, 21H2 and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2012 R2, 2016, 2019, 2022, and 2025, both in standard and Server Core installations. The vulnerability spans x86, x64, and ARM64 architectures as indicated by the CPE entries.

The reported CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, implying no confirmed exploitation yet. The likely attack vector requires the attacker to be authorized on a network that can reach the Device Association Service, meaning that remote adversaries with legitimate credentials or local users on the affected machines could exploit the read flaw. Because the exploitation path involves accessing a system service over the network, mitigations targeting network access or disabling the service can reduce the attack surface.