Windows Hyper‑V performs insufficient syntactic checking of certain input data, enabling an attacker with local authorized privileges to forge or spoof data. The flaw can allow the attacker to impersonate valid Hyper‑V entities or manipulate service interactions, potentially compromising the integrity of virtual machine operations and the confidentiality of contained data. Because the vulnerability requires a user to be authenticated and to have Hyper‑V access, it does not pose a remote exposure but can be leveraged by privileged insiders or compromised applications.

The flaw affects multiple Microsoft Windows client releases, including Windows 10 versions 1607, 1809, 21H2, and 22H2, as well as Windows 11 extensions 23H2, 24H2, 25H2, 26H2, and 26H1, and all Windows 11 arm64 or x64 variants listed. Server deployments also are impacted: Windows Server 2012, Server 2012 R2, Server 2016, Server 2019, Server 2022, and Server 2025, both full and core installations.

The CVSS v3.1 score of 8.8 classifies this as a high‑severity flaw, and the EPSS score is unavailable but the lack of public exploitation reports and absence from the CISA KEV catalog suggest exploitability is possible yet not yet widespread. The attack vector remains local, with an attacker needing legitimate administrative rights to Hyper‑V; elevated privileges are needed to influence virtual machine configuration or communications. Given the severity and the fact that the flaw can subvert state or identities within Hyper‑V, the risk is high for environments that rely on Hyper‑V isolation and data integrity.