The vulnerability is a buffer over‑read in the Windows StateRepository API that allows a local, authorized user to read beyond the bounds of a memory buffer. This flaw, identified as CWE‑126, can expose sensitive data stored in memory. The attacker does not need network access or elevated privileges beyond those required to invoke the API, and the exposure is limited to the local system.

Affected products include Microsoft Windows 11 versions 24H2, 25H2, 26H2, and 26H1, plus Windows Server 2025 and its Server Core installation. The CPE entries show support for both arm64 and x64 architectures.

The CVSS score of 5.5 places the vulnerability in the moderate range, indicating a reasonable level of risk but not critical. The EPSS score is not available, reflecting no current evidence of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw requires local authority, the attack vector is local with authorized users, and the attack can lead to a confidentiality breach by reading arbitrary memory sections within the affected systems.