An out‑of‑bounds read flaw in the Windows Audio Service permits a local attacker with authorized access to read unintended memory areas. The vulnerability can reveal sensitive data present in the service process, potentially exposing confidential information. The weakness is categorized as CWE‑125, indicating improper bounds checks on read operations.

Microsoft Windows 10 releases 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H1, and 26H2; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025. All supported architectures (x86, x64, and arm64) are impacted where the Windows Audio Service is present.

The CVSS score of 5.5 reflects a moderate severity for a local‑exploit scenario. The EPSS score is < 1%, indicating a very low likelihood of exploitation, and the vulnerability does not appear in the CISA KEV catalog. The attack vector is local and requires authorized user or system privileges; it cannot be leveraged remotely. An attacker could exploit the flaw by triggering the Audio Service to trigger the out‑of‑bounds read, thereby disclosing data that should be protected.