Having now read over this whole issue, I don't actually see where the security vulnerability is (on Windows at least).

This is a user-mode read, so it can only access memory in the same process, and it doesn't display it anywhere. The worst that can happen is that it hits an unreadable page and crashes, which falls under "undefined behaviour due to invalid input".

I think we should just revert the patch completely.