The vulnerability is an out‑of‑bounds read in the Windows Win32 Kernel Subsystem that can be exploited by an authorized local attacker to gain higher privileges. The flaw arises from an improper bounds check, potentially allowing an attacker to read sensitive memory and trigger a privilege escalation. An attacker who can execute code on the system could use this to bypass security controls and compromise the machine or affect nearby services.

The flaw affects Microsoft Windows 11 for versions 23H2, 24H2, 25H2, 26H2, and 26H1, as well as Windows Server 2022 and Windows Server 2025 (including Server Core). The affected releases run on both x64 and arm64 architectures. Users should verify whether their installations match these versions.

The CVSS score of 7.8 indicates a high severity local privilege escalation. The EPSS score is currently unavailable, and the vulnerability is not listed in CISA's KEV catalog, implying no publicly known exploits at the time. Attackers would need local access or a user with sufficient privileges to trigger the boundary check failure. Because the flaw stems from an out‑of‑bounds read, it is likely exploitable in the absence of additional mitigations, so applying the latest update is critical for protecting confidentiality, integrity, and availability.