A null pointer dereference exists in the Windows Hyper‑V component, allowing an attacker who is already authorized on the system to trigger a denial‑of‑service condition. The flaw is classified as CWE‑476, indicating a use‑after‑free or null dereference weakness that can crash or otherwise disrupt Hyper‑V’s operation. The impact is local: the attacker would be able to halt Hyper‑V services for the affected host, potentially affecting all virtual machines running on that host.

The vulnerability affects Microsoft Windows 10 releases 21H2 and 22H2, several Windows 11 releases including 23H2, 24H2, 25H2, 26H2, 26H1, as well as the 23H2 Windows 11 variant, and Windows Server 2022 and 2025 (including Server Core installations).

The CVSS score of 6.5 places the flaw in the medium severity band, and the EPSS score is not available. The vulnerability is not listed in CISA KEV. Exploitation requires local access privileges and Hyper‑V must be enabled. Because the attacker needs to be already authenticated and authorized on the host, the attack vector is local; remote exploitation is not possible. The risk is moderate, with potential to impact availability of virtualized workloads on the afflicted system.