A use‑after‑free flaw in the Windows Hyper‑V hypervisor permits an attacker with local privileges to execute arbitrary code on the host, potentially allowing the attacker to run any binary and gain elevated privileges.

Microsoft Windows 10 (Versions 1607, 1809, 21H2, 22H2), Microsoft Windows 11 (Versions 23H2, 24H2, 25H2, 26H2, 23H2, 26H1), Microsoft Windows Server 2016, 2019, 2022, 2025 (including Server Core installations).

The CVSS score of 8.8 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation to date. Attack likely requires an authorized, local attacker with access to a Hyper‑V environment; remote exploitation would generally not be feasible without additional compromise.