A null pointer dereference (CWE‑476) in the Windows Hyper‑V hypervisor code allows an attacker with local system access to trigger a crash of the Hyper‑V service, resulting in a denial of service for applications and services that depend on virtualization capabilities.

The flaw affects multiple Microsoft Windows releases. On Windows 10 the vulnerability exists in versions 1607, 1809, 21H2 and 22H2. On Windows 11 it is present in releases 23H2, 24H2, 25H2, 26H2 and 26H1. Windows Server environments from 2016 through 2025 also include the affected code paths.

With a CVSS score of 6.5 the issue is considered moderate. The EPSS score is not available, and the vulnerability is not currently listed in the CISA KEV catalog, indicating no public exploitation to date. The likely attack vector requires local privileged access, as the documented exploit requires an attacker who can execute code on the affected host.