This vulnerability involves a type confusion in the Windows Device Association Service where a resource is accessed using an incompatible type. The flaw permits an attacker who already has authorized local access to read sensitive data from the system. The weakness is characterized as CWE‑843, indicating a misuse of an object of an unexpected type. The exploitation would reveal local plaintext or binary information that the attacker might later leverage.

The flaw affects many recent Windows releases. It is present in Windows 10 releases from 1607 through 22H2, as well as Windows 11 releases from 23H2 to 26H2 (including ARM64 and x64 variants). Several Windows Server editions are also affected, such as Server 2012 R2, 2016, 2019, 2022 and 2025. The list of impacted platforms is extensive and spans both 32‑bit and 64‑bit architectures, covering standard and Server Core installations.

The CVSS score of 5.5 reflects a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, indicating that there are no known widespread exploits at this time. Because the attack requires an attacker to be already authorized on the host, the risk is confined to local users or processes that run with elevated privileges. In a typical environment, this means that a local administrator or compromised service account could exploit the flaw, but remote attackers would not be affected without additional compromise.