The vulnerability is an out‑of‑bounds read in Microsoft's Digest Authentication routine that can be triggered by a user who already has local authorization. An attacker with access to a user session can retrieve sensitive data from memory, leading to a local information‑disclosure scenario. This weakness aligns with CWE‑125 and can expose data that the user is entitled to but should not see beyond the authenticated session. The impact is confined to confidentiality and does not affect system integrity or availability directly.

Affected versions include Microsoft Windows 10 updates 1607, 1809, 21H2, and 22H2; Windows 11 updates 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server releases 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core images.

The CVSS score is 5.5, indicating moderate severity, and no EPSS data is available, suggesting limited public exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires local, authorized user privileges and a configuration that enables Digest authentication. While the risk is moderate, it is mitigated by limiting user privileges and disabling unnecessary authentication mechanisms.