A flaw in Windows Hyper‑V allows a user with appropriate authority to extract sensitive information from the host. The vulnerability is categorized as an information disclosure weakness (CWE‑200) and can be exploited by an attacker who already has local privileges to the system. The primary impact is that confidential data may be shown to the attacker without requiring additional privileges beyond those used to manage Hyper‑V.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, and 22H2, Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 26H1, as well as Microsoft Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025 (both standard and Server Core installations). All listed operating systems run the same Hyper‑V component that contains the disclosed flaw.

The CVSS score of 5.5 places this vulnerability in the Medium severity range, and no EPSS score is available, indicating that the likelihood of exploitation is not quantified. The vulnerability is not currently listed in the CISA KEV catalog. Based on the description, the attack vector is local; an attacker must have the ability to run or manage Hyper‑V on the target machine. Therefore, the exposure is limited to systems where an admin or Hyper‑V operator might already have access, providing a moderate risk if such accounts are compromised or overly privileged.