A race condition in the Windows Hyper‑V virtualization subsystem allows a local attacker to manipulate the order of configuration and management operations, bypassing security checks and thereby gaining elevated privileges on the host. The flaw is mapped to CWE‑367 and results in local privilege escalation rather than remote execution.

Affected products include Microsoft Windows 10 versions 1809, 21H2, 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, 26H1; and Windows Server 2019 (including Server Core), Windows Server 2022, and Windows Server 2025 (including Server Core).

The CVSS score of 7 indicates a moderate to high severity. EPSS data is not available, making current exploitation probability uncertain, and the vulnerability is not listed in CISA KEV. The vulnerability requires a local attacker who already has some level of authorized access to the host. While the impact is limited to the host machine, elevation of privileges can enable full system compromise once achieved.