A heap‑based buffer overflow occurs within Windows Hyper‑V. The flaw allows an attacker who already has authorized access to the Hyper‑V host to execute arbitrary code locally. This can lead to full compromise of the host system and the guest virtual machines that depend on it.

The vulnerability affects a range of Windows operating systems that include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2 for arm64, 26H1 for x64; and Windows Server versions 2016, 2019, 2022, and 2025 in both full and Server‑Core installations.

The CVSS score of 8.8 indicates high severity, while the EPSS score is not available, suggesting limited publicly observed exploitation data. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to be authenticated or otherwise authorized on the system, so the attack vector is likely local or via a privileged user interface, and it requires exploitation of the heap overflow in the Hyper‑V component.