This vulnerability arises from an out‑of‑bounds read in Windows Management Instrumentation. An attacker with local privileges can read memory that was not intended for them, allowing disclosure of potentially sensitive information. The weakness maps to CWE‑125, which denotes reading beyond the bounds of an allocated buffer.

Affected Microsoft Windows operating systems include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 (ARM64), 26H1, 26H2 (ARM64); and Windows Server releases 2012 R2, 2016, 2019, 2022, 2025 (including Core installations). All listed releases not yet updated with the latest service pack or cumulative update contain the flaw.

The CVSS score of 5.5 indicates a moderate severity, and the absence of a publicly available EPSS score implies no known mass exploitation. The flaw is local; it requires that the attacker already has login rights on the target machine. Because it does not require network access, remote attackers cannot exploit it unless they first acquire local credentials. The vulnerability is not listed in the CISA KEV catalog, so no widespread zero‑day exploitation has been reported.