An out‑of‑bounds read in the Network Policy Server (NPS) component allows an unauthorized attacker to read data from memory and send it over the network, exposing sensitive information that the server holds. The vulnerability is formally identified as a CWE‑125 flaw, which directly affects confidentiality by leaking confidential data without requiring user interaction.

The flaw affects multiple Microsoft Windows operating systems. Windows 10 releases version 1607, 1809, 21H2, and 22H2, and several Windows 11 editions including 23H2, 24H2, 25H2, 26H2, 26H1, as well as Windows 11 for ARM64‑based systems. Server editions impacted include Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, in both standard and server‑core installations.

The CVSS score of 7.5 indicates a high severity level for information disclosure. The EPSS score of 1% indicates a very low but nonzero exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, suggesting limited known exploitation. Based on the description, it is inferred that attackers can exploit this flaw remotely over the network by sending specially crafted requests to the NPS service. Successful exploitation would allow them to read protected data stored by the server, potentially compromising system confidentiality. The lack of explicit authentication requirements is inferred from the description, indicating that an attacker can potentially exploit the vulnerability as long as the NPS role is in use.