The Windows Hyper‑V heap‑based buffer overflow allows an unauthorized local attacker to run arbitrary code on the host system. From the impact described, the attacker can achieve full control of the machine, potentially compromising virtual machines and any sensitive data stored on them, thereby violating confidentiality and integrity.

Microsoft Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 21H2, Windows 10 Version 22H2, Windows 11 Version 23H2, Windows 11 Version 24H2, Windows 11 Version 25H2, Windows 11 version 22H3, Windows 11 version 26H1, Windows Server 2016, Windows Server 2016 (Server Core), Windows Server 2019, Windows Server 2019 (Server Core), Windows Server 2022, Windows Server 2022 (23H2 Edition Server Core), Windows Server 2025, Windows Server 2025 (Server Core)

With a CVSS score of 7.8, this vulnerability presents a high risk when an attacker can exploit the buffer overflow locally; the EPSS score was not available and it is not listed in the CISA KEV catalog. The flaw requires local execution privileges and does not appear to provide a remote trigger, but it allows code execution that could be leveraged for privilege escalation or further attacks unless mitigated.