A heap-based buffer overflow in the Windows Hyper‑V hypervisor allows an authorized attacker to execute code locally, resulting in local code execution. The flaw involves out‑of‑bounds writes (CWE‑122 and CWE‑787), enabling malicious requests to overwrite adjacent memory, potentially granting the attacker elevated privileges on the host. The impact is confined to the host system, but compromise can lead to full control of virtual machines and underlying services.

Affected products include Microsoft Windows 10 releases 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H1, and 22H3; and Windows Server 2016, 2019, 2022, and 2025, including all corresponding Server Core installations such as Windows Server 2016 (Server Core), Windows Server 2019 (Server Core), Windows Server 2022 (Server Core), Windows Server 2025 (Server Core), and Windows Server 2022 23H2 (Server Core). All these versions are impacted by the Hyper‑V heap‑overflow vulnerability.

The CVSS score is 7.3, indicating high severity. The EPSS score is below 1%, implying a very low probability of exploitation in the wild, and the vulnerability is not currently listed in the CISA KEV catalog. Likely exploitation requires an attacker with local user or administrator privileges who can control or influence Hyper‑V operations; remote exploitation from external attackers is not supported by the current information.