The vulnerability is a buffer over‑read in the Windows Win32 Kernel Subsystem that allows an attacker with local authority to read data beyond intended bounds. The result is the disclosure of sensitive system information that could be used to attack other parts of the operating system. This weakness is classified as CWE‑126, indicating an insufficiently bounded read operation.

Affected products include Microsoft Windows 10 Version 1809, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 Version 23H2, Windows Server 2019, Windows Server 2022, and Windows Server 2025 (including Server Core editions).

The CVSS score of 5.5 indicates a moderate risk. No EPSS score was reported, and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not currently being widely exploited. The attack vector is local, requiring an authorized attacker who has at least normal user privileges on the affected system. Because the flaw is a local kernel read, it does not provide remote code execution or privilege escalation by itself, but the data exposed could aid further attacks.