This vulnerability is an out‑of‑bounds read in the Windows Volume Manager Extension Driver. If an authorized local user exploits it, the attacker can read memory beyond valid boundaries, leading to elevated privileges and the ability to execute arbitrary code at higher privilege levels. The flaw aligns with CWE‑125: Out‑of‑Bounds Read, enabling the abuse of memory to gain unauthorized administrative rights.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server versions 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations.

The CVSS score of 7.8 classifies this flaw as high severity, indicating substantial risk if an attacker succeeds. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, so its exploitation probability remains uncertain. The attack vector is local; an attacker must have authorized or physical access to the machine. Once exploited, the out‑of‑bounds read can be leveraged to elevate privileges, potentially compromising system integrity and confidentiality across the affected environment.