Out-of-bounds read has been identified in the Windows Key Storage Provider, allowing an attacker who already has authorized local access to read memory outside intended bounds. This flaw can leak sensitive data contained in the provider’s memory space, potentially exposing cryptographic keys or personal information. The weakness is classified as CWE-125, a classic out-of-bounds read issue that undermines confidentiality.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; Microsoft Windows Server 2016, 2019, 2022, and 2025. The impacted builds include x86, x64, and arm64 architectures as listed in the vendor’s release notes.

The CVSS score of 5.5 indicates moderate severity; the EPSS score is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires local or privileged user access, meaning an attacker must already be authenticated or present on the machine. Once the local conditions are met, the attacker can trigger the out-of-bounds read to capture sensitive data from the Key Storage Provider’s memory, potentially compromising encryption keys or other confidential information.