The identified bug is an out‑of‑bounds read in the Windows kernel that can be triggered by an authorized user to elevate privileges locally. The vulnerability stems from improper memory bounds checking (CWE‑125). If exploited, the attacker can gain higher privileges, potentially leading to full control of the affected system. The read does not directly leak sensitive data but enables privilege escalation.

Microsoft Windows 11 versions 24H2, 25H2, 26H2, and 26H1 and Windows Server 2025, including Server Core installations, are affected. An authorized attacker on these systems could exploit the flaw.

The CVSS score of 7.8 indicates high severity. The EPSS score is not reported, leaving uncertainty about current exploitation rates. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, requiring authorized or locally logged‑on user privileges. Because the flaw is a kernel memory access bug, it can be leveraged by privileged users to gain elevated permissions.