A double free condition in the Windows Hyper‑V hypervisor allows a locally authenticated attacker to execute code with higher privileges. This flaw can be abused by an attacker who already has some level of local access to invoke memory handling errors and gain system‑level rights, potentially enabling full system compromise. The vulnerability is a direct result of improper memory deallocation, classified as CWE‑415, and does not involve external input or network exploitation.

Microsoft Windows 11 version 23H2, 24H2, 25H2, 26H2 (both ARM64 and x64 builds) and Windows Server 2022, Windows Server 2025 (including Server Core installations) are affected. These systems run the Hyper‑V virtualization stack that has the double free flaw.

The CVSS score of 7.8 indicates a high severity for local privilege escalation, but the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local: an attacker must possess some level of user access to craft a payload that triggers the double free. While the attack does not extend over a network, compromising local privilege can lead to full system takeover. Security teams should treat this as a high‑risk issue for environments where Hyper‑V is used or exposed to untrusted users.