Improper input validation in Windows Hyper‑V allows an attacker with local access on a host to execute arbitrary code. Because the flaw lies in the virtualization stack, exploitation would give the attacker full control of the host operating system, enabling theft of sensitive data, installation of malware, or further lateral movement. The vulnerability is identified as buffer overrun and array bounds problems (CWE‑122, CWE‑125, CWE‑20).

The flaw affects Microsoft Windows 10 releases 1607, 1809, 21H2, 22H2, and Windows 11 versions 23H2, 24H2, 25H2, 26H1, 22H3, 26H1 as well as Windows Server 2016, 2019, 2022, 2025. All Hyper‑V hosts running these operating systems are potentially vulnerable.

The CVSS score is 7.3 indicating high severity, while EPSS is below 1 %. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have authorization to interact with the Hyper‑V environment; a likely attack vector is through a compromised guest or an administrator capable of interacting with the hypervisor. The flaw resides in a local privilege context, making remote exploitation unlikely without prior host access.