An out-of-bounds read in the Remote Desktop Display Driver has been identified, allowing a local user with authorized access to read unintended memory contents. The flaw resides in bounds checking during driver operation and results in the disclosure of sensitive data that resides outside the intended buffer area. The exposed data could include configuration details or other information stored in memory but does not directly give control or modify system state.

Microsoft Windows 10 21H2 and 22H2, Windows 11 23H2, 24H2, 25H2, 26H2 and 26H1, Windows Server 2022, Windows Server 2025 and server core installations of Windows Server 2025, as well as arm64 based 11 installations, are affected by this flaw.

The CVSS score of 5.5 indicates a moderate risk to confidentiality. The EPSS score is not available, but no usage is currently documented in the CISA KEV catalog. Attackers must already be authenticated on the local system to exploit the flaw, which limits exploitation to privileged or malicious local users. Given the local attack vector and the moderate severity, the overall risk to an organization hinges on the prevalence of unauthorized local users and the value of the disclosed data. Regular patching mitigates this risk.