This vulnerability is an improper link resolution before file access in the Windows Hyper‑V virtual machine monitor. A local attacker who can trigger the link‑following logic may cause the system to open a file path that the user does not own, allowing the attacker to execute arbitrary code with the highest privileges. The flaw is a classic path traversal (CWE‑59) and results in local privilege escalation, potentially compromising all confidential data and system integrity.

Affected versions include Microsoft Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H2, 26H1) across x86, x64, and arm64 architectures, and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022 and 2025 in both Server Core and full installations. All listed systems run the Hyper‑V hypervisor.

The CVSS score of 7.8 indicates a high severity for local exploits. There is no publicly available EPSS score and the vulnerability is not listed in the CISA KEV catalog, which suggests it is not a widely observed exploitation target yet. However, because the required attacker is already a local user, any compromise of user credentials or misassigned local accounts could allow the privilege escalation. The likely attack vector is direct local interaction with the Hyper‑V API or configuration files, and exploitation would give the attacker complete control of the host system.