A buffer over-read flaw in the Windows Hyper-V hypervisor enables an attacker with authorized or privileged access to trigger a denial of service against an adjacent network. The vulnerability can exhaust resources or destabilize the virtual machine environment, causing connectivity loss for services running within the affected system.

The issue targets multiple Microsoft Windows client and server platforms. Client releases affected include Windows 10 versions 1607, 1809, 21H2, 22H2 and Windows 11 versions 24H2, 25H2, 26H1. Server releases impacted are Windows Server 2012 (both standard and Server Core editions), 2016, 2019, 2022, and 2025, again in both full and Server Core configurations.

With a CVSS base score of 4.5 the vulnerability is classified as moderate in severity, and an EPSS score of less than 1% indicates a low likelihood of exploitation in the wild. The flaw requires a user to have authorized or elevated privileges on the host system; the attack is not remotely exploitable from the network. No active exploitation campaigns are currently documented, and the vulnerability is not listed in the CISA KEV catalog.