An out-of-bounds read occurs in the Windows Wi‑Fi driver when a packet is processed. This allows an attacker to read memory beyond the intended buffer and transmit that data over an adjacent network, exposing sensitive information. The flaw is a classic example of CWE‑125, a partial read vulnerability that compromises confidentiality.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, along with Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1. Windows Server devices from 2016 through 2025 (including core installations) are also vulnerable.

The CVSS score of 5.7 indicates a medium severity vulnerability. EPSS data is unavailable, and the issue is not in the CISA KEV catalog, suggesting that the exploitation rate is currently unknown and likely low. The likely vector is an authorized user or a device in close network proximity, meaning an attacker must already have some level of local or adjacent network access to exploit the flaw.