The vulnerability is an out‑of‑bounds read in the Windows Device Association Service. An attacker with local privileges can trigger the flaw and read memory beyond its intended bounds, which may expose sensitive data. The impact is limited to information disclosure rather than code execution or privilege escalation. The weakness is categorized as improper memory bounds handling, a typical out‑of‑bounds read.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2 and Windows 11 versions 23H2, 23H2 (arm64), 24H2, 25H2, 26H2, 26H1 as well as the corresponding arm64 and x64 builds. The vulnerability also affects Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including both standard and Server Core installations. All affected systems run the Device Association Service component that can be exploited locally.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is not available, making it unclear how frequently this flaw has been exploited in the wild. It is not listed in the CISA KEV catalog, suggesting no publicly known or confirmed exploitation. The attack vector is local; an authorized user or process that can invoke the Device Association Service can exploit the out‑of‑bounds read. No network or remote attack path is identified in the description.