The vulnerability is an out‑of‑bounds read occurring in the Windows Hyper‑V virtualization layer. An attacker with authorized local access can trigger the read and retrieve data from memory that should not be exposed. This results in disclosure of potentially sensitive information such as configuration data, files, or secrets, but does not allow escalation of privilege or code execution.

Affected are Microsoft Windows 10 versions 1809, 21H2, 22H2, Windows 11 versions 23H2 through 26H2, as well as Windows Server 2019 and 2022 (including Server Core installations) and the upcoming Server 2025 releases. The vulnerability is present in both x86 and x64 builds, and in ARM64 variants of Windows 11.

The CVSS score of 6.5 indicates a moderate seriousness. The EPSS value is not available, and the vulnerability has not been flagged in the CISA KEV catalog, suggesting no publicly known exploit activity. The likely attack vector is local; the attacker must have authorized access to the Hyper‑V host or a guest with elevated privileges. Successful exploitation would lead only to information disclosure and not to arbitrary code execution or a denial of service environment.