The vulnerability is an out‑of‑bounds read in the Windows Hyper‑V hypervisor. The flaw occurs when a specially crafted data buffer is processed, enabling a local attacker to read memory beyond the intended boundary. This read can be leveraged to gain unauthorized elevated privileges on the host, giving the attacker potential access to any resource the host can access.

Affected Windows operating system families include Windows 10 versions 21H2 and 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2 and 26H1, and Windows Server 2022 and 2025, including Server Core installations. All impacted releases are listed in the Microsoft security update guide.

The CVSS score of 8.2 indicates a high severity local privilege escalation. The EPSS score of < 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The attack requires local authorized access, so any user with sufficient local privileges can trigger the flaw. Prompt application of the Microsoft patch will mitigate this risk.