The Windows Device Association Service contains an out‑of‑bounds read that can be triggered by an authorized local user. The flaw allows the attacker to read memory beyond the intended buffer and reveal potentially sensitive information. This results in confidentiality compromise rather than denial‑of‑service or execution.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2, and Windows 11 releases 23H2, 24H2, 25H2, 26H2, 26H1, as well as Windows Server 2012 through 2025 (including core installations and ARM64 variants). The vulnerability applies to all listed operating systems that have not yet applied the Microsoft update.

CVSS score 5.5 indicates moderate risk. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack requires local authorization or a privilege level sufficient to interact with the Device Association Service, which is a standard service running under system privileges. Because the flaw is an information‑disclosure bug rather than a privilege‑escalation vector, the exploit surface is limited to machines where the attacker already has local access. An attacker could use the disclosed data to aid further attacks but cannot directly obtain higher privileges.