The vulnerability is an out‑of‑bounds read in the Windows Universal Disk Format (UDFS) file system driver. An attacker who has local, authorized access could trigger the driver to read memory beyond the intended data buffer, leaking confidential information present on the host. The weakness falls under CWE‑125. Because the attack requires local privileged or otherwise authorized execution, the impact is limited to information disclosure rather than remote code execution or denial of service.

Affected by this flaw are Microsoft Windows clients and servers that include the UDFS driver. Windows 10 variants 1607, 1809, 21H2, and 22H2; Windows 11 editions 23H2, 24H2, 25H2, 26H2, and 26H1; as well as Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including their Server Core installations. All builds that contain the vulnerable UDFS component are susceptible until the update that replaces the driver is applied.

The CVSS base score of 5.5 indicates moderate severity, and no EPSS score is available, meaning the exploitation probability is unknown. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need local authorized credentials or the ability to execute code in the context of a privileged process to make the out‑of‑bounds read. Once triggered, the attacker can read portions of memory that may contain passwords, cryptographic keys, or other sensitive data. Therefore, while the risk is limited to local systems with UDFS support, organizations should address the issue promptly.