The vulnerability is a use‑after‑free bug in the Windows Hyper‑V hypervisor that lets a local attacker who already has authorization on a system execute code with elevated privileges. This can enable the attacker to gain full control of the host, allowing data disclosure, tampering, and potential lateral movement within the network. The weakness is classified as CWE‑416, indicating a flaw in memory management that leads to unsafe dereference of freed objects.

Affected products include Microsoft Windows 11 in the 23H2, 24H2, 25H2, 26H1 releases (and the earlier 22H3 variant) as well as Windows Server 2022 and Windows Server 2025, including Core installations. The Microsoft security update addresses the Hyper‑V component in all these versions.

The CVSS score of 7.0 indicates moderate to high severity, while the EPSS score of less than 1% suggests that the likelihood of exploitation in the wild is currently low. The vulnerability is not listed in the CISA KEV catalog. Because the exploitation requires a local, authorized attacker, the primary risk is to users with administrative or elevated permissions on the host. Prompt application of the Microsoft security update reduces the attack surface and mitigates the privilege escalation opportunity.