Windows Hyper‑V includes an improper access control flaw that permits an attacker with local authorization to obtain sensitive data from the host. The vulnerability is classified as CWE‑284 and results in information disclosure rather than code execution or denial of service. The exposed data could include configuration details or other internal state that an attacker might use for further compromise.

The flaw affects Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 22H3, 23H2, 24H2, and 25H2; Windows Server 2019; Windows Server 2022; Windows Server 2025 and their Server Core installations.

The CVSS score of 4.4 indicates moderate severity, while the EPSS score of less than 1% signals a very low probability of exploitation. The vulnerability is not in the CISA KeV catalog. Exploitation requires local, authorized access to a host that has Hyper‑V enabled, making the attack vector local. An attacker would need to be authenticated with a user account on the system and then leverage the access control defect to read privileged information.