The vulnerability is an out‑of‑bounds read in the Windows Universal Disk Format (UDFS) file system driver. When triggered, an attacker who has authorized local access can read memory locations beyond the intended buffer, exposing potentially sensitive data. The flaw is a classic information‑disclosure weakness (CWE‑822) and does not allow code execution or denial of service.

Affected products are Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2 and Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (including core installations).

The CVSS base score of 5.5 indicates a moderate risk. EPSS is unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited public exploitation data. The attack requires a local user with legitimate access – the exploit is local and does not rely on network connectivity. Because the flaw is a bounded read, it cannot be escalated to privilege or to remote compromise without additional vulnerabilities.