An untrusted pointer dereference occurs in the Windows Search component when it processes certain user‑supplied data. The flaw permits an attacker with authorized access on the local machine to read sensitive information that should not be exposed. Because the vulnerability is confined to the host, the primary impact is a local information disclosure and it maps to CWE‑822.

The vulnerability affects Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2 and Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025. These include both Server Core and full installations.

The CVSS score of 5.5 indicates moderate severity. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread exploitation reports. Attackers must already have local user privileges to trigger the dereference; no network or elevation vector is required. Without the patch, an authorized user could exploit the flaw by interacting with the search component, but the absence of a public exploit reduces immediate risk.