Integer underflow (wrap or wraparound) occurs in Windows Hyper‑V, enabling an authorized attacker to cause a denial of service over a network. The flaw allows the attacker to corrupt internal counters or calculations, leading to a crash of the Hyper‑V service. An attacker who can authenticate or gain sufficient privileges could repeatedly trigger this vulnerability, resulting in loss of availability of virtual machine host services and potentially impacting hosted workloads.

Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 22H3, 23H2, 24H2, and 25H2; Windows Server 2012 R2 (full and Server Core installations), Windows Server 2016 (full and Server Core installations), Windows Server 2019 (full and Server Core installations), Windows Server 2022 (full and Server Core installations, including the 23H2 edition), Windows Server 2025 (full and Server Core installations).

With a CVSS score of 5.3, the vulnerability carries a moderate severity. The EPSS score is below 1%, indicating a low likelihood of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be remote network‑based, requiring an attacker who already has authorized or privileged access to the affected host. Exploitation would involve sending crafted data that triggers the integer underflow, causing the Hyper‑V service to crash and denying service to virtual machine workloads.