An out-of-bounds read in the Windows USB Print Driver allows an attacker who is authorized to observe sensitive data present on the local system. The flaw arises when the driver processes USB printer messages and fails to check array bounds before accessing memory, exposing the contents of adjacent memory locations. This information disclosure could include configuration values, temporary files, or other data that resides next to the buffer, potentially revealing secrets or system state.

Microsoft Windows 10 releases from version 1607 through 22H2, Microsoft Windows 11 releases from version 23H2 through 26H2, and multiple Windows Server editions—including 2012, 2012 R2, 2016, 2019, 2022, and 2025—are affected. These include both x86‑64 and ARM64 builds as specified in the CVE note.

The vulnerability carries a CVSS score of 5.5, indicating moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The exploit requires local, authorized access to the target machine—typically achieved by installing a malicious USB printer driver or connecting a compromised printer. Once the driver runs, the attacker can read portions of memory that were not intended for disclosure, potentially compromising local confidentiality but not providing remote code execution or denial of service.