The vulnerability is an out‑of‑bounds read in components of the Windows Print Spooler. An attacker who can cause the spooler to read beyond the bounds of a buffer can obtain sensitive data from memory, resulting in information disclosure. The flaw is a buffer overread (CWE‑125).

Affected systems are Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1 (including both x64 and ARM64 builds); and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core installations.

The CVSS score is 7.5, indicating a high‑severity vulnerability. EPSS score 1%, and the issue is not listed in CISA’s KEV catalog. Attackers would need network access to the host to trigger the out‑of‑bounds read, so the risk is most pronounced in environments where the Print Spooler service is exposed to a local network or the internet. Without a patch, the flaw can leak confidential data from the spooler’s memory space.