This vulnerability (CVE-2026-45604) involves an out-of-bounds read in the Windows Application Identity (AppID) Subsystem on Windows 11 version 23H2 (build 10.0.22631.0). An authorized attacker with local access can exploit this to read memory outside the intended bounds, potentially disclosing sensitive information. The vulnerability does not allow privilege escalation, denial of service, or remote exploitation. Microsoft has released an official fix to remediate this issue.

The vulnerability allows an authorized local attacker to read memory beyond the intended boundaries in the AppID subsystem, leading to potential disclosure of sensitive information. There is no impact on system integrity or availability, and no indication of remote exploitability. The confidentiality impact is rated high, while integrity and availability impacts are none.

An official fix is available from Microsoft. Users and administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45604 to remediate this vulnerability.