A buffer over-read bug in the Windows USB driver allows a local, authorized attacker to read memory beyond the intended boundary, enabling disclosure of sensitive data from the system. The vulnerability arises from improper handling of user-controlled input within a kernel driver and is classified as CWE-126.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including Server Core installations. These releases support x86, x64, and ARM64 where applicable.

The CVSS score of 5.5 indicates moderate severity; exploitation requires local access and appropriate privileges to load the USB driver. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, large-scale exploitation is unlikely, but the risk remains for environments that allow local user access to USB devices. Immediate remediation is advised to prevent potential memory disclosure.