An out‑of‑bounds read occurs inside the Windows WebDAV service, allowing an attacker who has local user authority to read memory beyond intended bounds and access sensitive data that resides in memory or a page. The vulnerability cannot be exploited remotely; an attacker must be able to log on locally or have access to a local privileged account. Because the attacker can read memory, the attacker may view configuration settings, credentials, or other confidential information, potentially compromising system confidentiality. The flaw is a classic out‑of‑bounds read (CWE‑125).

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (including server core installations) are affected. The vulnerability resides in the local WebDAV implementation bundled with these OS releases.

The CVSS base score of 5.5 indicates moderate severity. The attack requires local authorized access and does not currently have an EPSS score or KEV listing, implying no widespread exploitation data. Nonetheless, the vulnerability permits disclosure of sensitive memory content, so any local accounts with administrative or web‑server privileges should be considered at risk. Mitigation should focus on applying patches and ensuring WebDAV is only enabled where necessary.