An improper access control flaw within Windows Hyper‑V permits an attacker who already has authorized local access to execute arbitrary code on the affected system. This vulnerability is characterized by the CWE‑1419 and CWE‑863 identifiers, indicating a failure to enforce the appropriate access restrictions. The attacker can compromise the confidentiality, integrity, and availability of the operating system by running code with the privileges of the authenticated user, potentially affecting all running services and processes on the host.

Microsoft Windows 10 21H2 and 22H2, Windows 11 23H2, 24H2, 25H2, 26H2, 26H1, Windows Server 2022, and Windows Server 2025 (including Server Core installations). These versions incorporate the Hyper‑V virtualization component that is vulnerable.

The CVSS score of 8.8 classifies this flaw as a high‑severity local privilege escalation. The EPSS score of 0.00376 indicates a very low but non‑zero chance of exploitation. It is not listed in the CISA KEV catalog, so there is no evidence of widespread active attacks. Likely attack vectors involve a local user with sufficient rights to manage Hyper‑V settings or a compromised account that can interact with the Hyper‑V service. Because the defect requires local authorization, the risk is limited to environments where privileged users have direct access to the host, but successfully exploiting it could allow the attacker to run code with the user's privileges, potentially compromising all running services and processes on the system.