The flaw is a race condition between a check and a use of kernel data in the Win32 subsystem. An authorized local user can trigger the race and read kernel memory, which may expose system information such as credentials or configuration data. The vulnerability does not allow a change in control, integrity or availability, but it provides confidential data to an attacker, and it is classified as CWE‑367.

Microsoft Windows builds from 10 version 1607 through 22H2, various Windows 11 releases (23H2, 24H2, 25H2, 26H2, 26H1) and Windows Server releases including 2012, 2012 R2, 2016, 2019, 2022 and 2025 are affected. The specific affected components are all instances of the Win32 kernel subsystem within these operating systems.

The CVSS score of 4.7 marks this as a moderate severity vulnerability. No EPSS value is available, and it is not included in the CISA KEV catalog, so the documented probability of exploitation is unknown. Based on the description, the attack requires local, authorized access—an attacker must be logged into the target machine or possess privileged credentials to trigger the race condition—this limits the attack surface relative to remote exploits. The race condition may also be difficult to reliably reproduce under typical operating conditions, further reducing practical exploitation risk.