An out‑of‑bounds read bug in the Windows Universal Disk Format File System Driver (UDFS) allows an attacker with local authorization to read memory that should be protected, potentially exposing sensitive data. This weakness is classified as CWE‑125 and directly impacts the confidentiality of information on devices that use UDFS media.

All Microsoft products listed as affected are impacted: Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2, and 26H1; Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025 across their standard and server‑core installations. Every mentioned release contains the vulnerable UDFS driver and is therefore at risk.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires local authorization; an attacker who can run code on the target machine can trigger the out‑of‑bounds read to leak protected data. Because the vulnerability does not enable remote code execution or privilege escalation, the risk is limited to information disclosure, but the impact can be significant if the disclosed data is sensitive.