A type confusion flaw in the Windows Message Queuing Queue Manager can allow an attacker who is authorized on the system to read data that should be inaccessible. The bug is triggered by improper handling of incompatible types, enabling local disclosure of protected information.

The vulnerability affects a broad range of Microsoft products, including Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H1, and 26H2; and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, across x86, x64, and ARM64 architectures.

With a CVSS score of 5.5 the flaw is rated medium severity. No EPSS score is available and it is not listed in the CISA KEV catalog. The likely attack vector is local, requiring an authorized user or privileged account to interact with the Message Queuing service to trigger the type confusion. Although it does not allow remote code execution, the potential to leak confidential data elevates the risk to organizations that rely on thorough data isolation.