This vulnerability, identified as CWE-822 (Untrusted Pointer Dereference), exists in the Windows Win32K subsystem of Windows 11 version 23H2 (build 10.0.22631.0). It allows an authorized attacker with local access and low privileges to cause the system to dereference untrusted pointers, leading to information disclosure. The CVSS v3.1 base score is 5.5, reflecting a medium severity with high confidentiality impact but no integrity or availability impact. The vulnerability has been officially fixed by Microsoft, as indicated in their security update guide.

An authorized local attacker can exploit this vulnerability to disclose sensitive information from the affected system. There is no impact on system integrity or availability. The attack complexity is low, and no user interaction is required. No known exploits are reported in the wild at this time.

An official fix is available from Microsoft. Users and administrators should apply the security update provided by Microsoft for Windows 11 version 23H2 (build 10.0.22631.0) as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62798. Applying this update mitigates the vulnerability.