The flaw is an out‑of‑bounds read in Windows Remote Access Service Infrastructure that allows a local attacker with appropriate privileges to read memory beyond a buffer, resulting in disclosure of sensitive data such as passwords or configuration information. This weakness, classified as CWE‑125, leads to information leakage but does not enable arbitrary code execution or denial of service.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both full and server core installations).

The CVSS score of 5.5 indicates moderate risk. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. Based on the description, it is inferred that exploitation requires local administrative or Service/Network privilege to interact with the Remote Access Service. Based on the description, it is inferred that widespread remote exploitation is unlikely without prior compromise, though disclosed information could facilitate further attacks if additional privileges are obtained.