Memory-layout disclosure via NTLM out-of-bounds read

An out-of-bounds read in the Microsoft Windows NTLM SSP allows remote attackers to disclose memory-layout information via crafted NTLM traffic. The NTLM SSP processes attacker-controlled authentication data without adequately validating a buffer boundary, causing a read beyond allocated data; Microsoft has not publicly identified the responsible function or field. Exploitation requires no credentials or user interaction, but the attacker must prepare the target environment to make the high-complexity disclosure reliable, and the reported impact is limited to confidentiality.