An out-of-bounds read flaw in the Windows Hyper‑V hypervisor enables an attacker with the ability to supply input to the hypervisor to read beyond allocated memory. The flaw is a classic heap corruption weakness (CWE‑122). If successfully exploited, the attacker could inject or manipulate data that subsequently executes within the Hyper‑V kernel context, granting the attacker the capability to run arbitrary code with kernel‑level privileges on the host system.

This vulnerability affects Microsoft Windows 11 23H2, 24H2, 25H2, 26H1 and Windows Server 2022, Server 2025, including the Server Core installation. All listed versions are impacted by the identified out-of-bounds read flaw.

The CVSS score of 8.2 classifies this issue as high severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. No remote exploitation path has been confirmed by the description, and the most probable scenario would require local access to the Hyper‑V environment; the CVE description does not specify the exact attack vector, so it is inferred that the attacker would need to interact with the Hyper‑V subsystem from a privileged or compromised local account.