Buffer over-read in Windows Management Instrumentation allows an authorized local user to read memory beyond intended bounds, exposing sensitive information that may include credentials, personal data, or system configuration. The weakness is a classic memory safety flaw, classed as CWE-126. The vulnerability requires local authority; an attacker must have a user account on the target system, but does not need administrative privileges to trigger the data leakage. Once exploited, the attacker can gain unauthorized access to confidential data browsable through WMI queries or scripts. Current CVSS is 5.5, indicating moderate severity. EPSS is unavailable and the issue is not listed in CISA KEV, suggesting no publicly confirmed exploits yet, but an active local attacker could use the flaw to compromise data confidentiality.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Microsoft Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1; Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, 2025 (including Core installations).

The risk is moderate with a CVSS of 5.5 and no public exploits reported. Because the attack requires local user access, the exploitation scope is limited to the compromised account; however, any privileged account that can execute WMI requests could read sensitive data. Deployment of the available Microsoft patch eliminates the buffer over-read bug and removes the information disclosure vector.