This vulnerability is an out-of-bounds read in the Windows Imaging Component that allows an attacker with local, authorized access to read data outside the bounds of a memory buffer. The resulting information disclosure can expose sensitive local data, potentially compromising confidentiality of files or configuration values. The weakness corresponds to CWE-125, a classic buffer overread flaw.

Affected are Microsoft Windows 10 (builds 1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H2, and 26H1), and Windows Server editions from 2012 to 2025, including both full and Server Core installations. All listed versions contain the unpatched Windows Imaging Component that can be exploited.

The CVSS score of 5.5 indicates a moderate severity, and because the attack requires local, authorized privileges, the immediate threat to non‑privileged users is limited. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog, suggesting limited active exploitation. Nonetheless, any host that can be compromised by a local authorized user—such as administrators or compromised applications—can potentially trigger the out-of-bounds read. Hyper‑privileged or root contexts amplify the risk, allowing broader information leakage.