A buffer over‑read occurs within the Servicing Stack Updates that run when Windows applies updates. Because the memory bounds are not respected, an attacker who is authorized to execute code locally on the affected system can read beyond a buffer and retrieve sensitive data. The vulnerability is classified as CWE‑126 and has a CVSS score of 5.5, indicating a moderate impact to confidentiality and integrity for local users.

The exploit affects Microsoft Windows 11 24H2, 25H2, 26H2, and 26H1 (both ARM64 and x64 editions) as well as Windows Server 2025, including the Server Core installation. All these versions rely on the Servicing Stack component for updating and are vulnerable when the component is at a pre‑patched level.

The risk is moderate because the attack requires local or privileged execution on the target machine, which may be available to administrators or compromised accounts. The EPSS score is not provided, and the vulnerability is not listed in CISA's KEV catalog, so there is currently no evidence of widespread exploitation. Nevertheless, the Common Vulnerabilities and Exposures database assigns a CVSS of 5.5, signalling that once local access is achieved, sensitive information could be inadvertently disclosed.