An attacker who can execute code locally can exploit an uninitialized resource in Windows kernel‑mode drivers, allowing the disclosure of sensitive data such as passwords or system state. The flaw is a classic example of CWE‑908, which permits the return of data that has not been properly initialized, thereby leaking information that the attacker should not have access to.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and 26H1; and Windows Server 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core installations.

The CVSS score of 5.5 indicates a moderate severity, and the vulnerability is limited to local accounts with sufficient privileges to interact with kernel‑mode drivers. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is a local attacker exploiting an authenticated context, making the risk most significant for systems with elevated local privileges and insufficient role separation.