This vulnerability is an out‑of‑bounds read in the Windows Message Queuing Queue Manager, permitting an unauthenticated attacker to read arbitrary memory contents and transmit the data over a network. The information disclosed could include sensitive configuration data or other confidential data that the system holds in memory. The weakness is identified as CWE‑125, an improper memory read that compromises data confidentiality.

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2), Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H2, 26H1), and Microsoft Windows Server 2012 through 2025 (including 2012 R2, 2016, 2019, 2022, 2025). Target systems must have the Windows Message Queuing service enabled or otherwise exposed to network traffic.

The CVSS score of 7.5 indicates a high severity of confidentiality impact. EPSS score of 1% indicates a low but nonzero probability of exploitation, though no large‑scale exploitation has been documented and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, delivered over a network to the Queue Manager service, and requires no authentication, making it potentially useful to threat actors seeking to exfiltrate data from a target system.