The vulnerability is a heap‑based buffer overflow in the Hyper‑V hypervisor component of Windows. When a local user with the ability to interact with Hyper‑V triggers the flaw, the memory corruption can be exploited to execute code with elevated privileges, potentially giving the attacker system-wide control. The weakness is defined as CWE‑122, a classic buffer overflow that can compromise confidentiality, integrity and availability on the affected system.

Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2 and Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, along with Windows Server 2012, 2012 R2, 2016, 2019, 2022 and 2025 (both full and Server Core installations). All of these contain the Hyper‑V virtualization stack that is affected by the buffer overflow.

The vulnerability carries a CVSS score of 7.2, indicating a high risk when the conditions are met. EPSS data is not available, so the likelihood of exploitation cannot be quantified, but because the attack requires local, authorized access it is not a remote threat vector. The vulnerability is not listed in the CISA KEV catalog, suggesting no widespread active exploitation yet. A local attacker who can run Hyper‑V commands is able to trigger the overflow, gain elevation, and potentially use that access to compromise the entire host.