The vulnerability is an out‑of‑bounds read in the Windows Hyper‑V hypervisor that can be triggered by an unauthorized local attacker. The out‑of‑bounds read can be leveraged to read memory beyond the intended buffer and ultimately execute arbitrary code on the host system. The weakness is identified as CWE‑125 and the CVSS score of 8.4 indicates a high severity of potential impact on confidentiality, integrity and system availability if exploited. The attack vector is inferred to be local, requiring the attacker to be able to run code on the compromised machine but not needing network access.

Affected products include Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2 and Windows 11 versions 23H2, 24H2, 25H2, 26H1, as well as Windows Server 2016, 2019, 2022, and 2025 (including Server Core editions). The affected releases span a wide range of desktop and server editions, encompassing both x64 and ARM64 architectures.

The CVSS score of 8.4 reflects substantial risk, while the EPSS score is not available, meaning the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a local attacker who can execute code on the system, but the lack of network‑based attack requirements reduces the opportunity for remote exploitation. As long as the Hyper‑V component remains enabled, the vulnerability could be abused in environments where privileged local users or malicious software have been installed.