An out‑of‑bounds read in Windows Network File System enables an authorized attacker to elevate privileges locally. The flaw occurs when network file requests are processed and memory beyond the intended bounds can be read, potentially exposing sensitive data. If successfully exploited, the attacker can acquire higher local privileges, compromising the confidentiality and integrity of the system.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 (including Server Core installations). These releases are impacted by the out‑of‑bounds read flaw in the Windows Network File System component.

The CVSS score is 7, indicating high severity. The EPSS score was not provided, so current exploitation probability is unknown. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is local: an authorized user can trigger the flaw via network file system operations, elevating privileges and potentially achieving full system compromise.