The vulnerability arises from the use of uninitialized memory in Windows kernel-mode drivers. An attacker with local, authenticated access can exploit this flaw to read data that should not be exposed, resulting in a local information disclosure incident. The weakness corresponds to CWE-908, indicating a misuse of uninitialized resources that can expose sensitive information.

Microsoft Windows 11 version 26H1 on arm64 architecture is affected. No other vendors or product versions are listed for this CVE.

The CVSS score of 5.5 reflects moderate severity. Because EPSS data is unavailable, the likelihood of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. Attackers are limited to local, authenticated execution on the vulnerable host, which permits disclosure of confidential memory data but does not provide privilege escalation or remote code execution.