A heap-based buffer overflow in Windows Hyper‑V enables an authorized attacker to read information from memory and send it over the network. This flaw provides the attacker with partial confidentiality disclosure of data residing in the Hyper‑V process heap, as defined by CWE-122.

The vulnerability affects multiple Microsoft Windows releases. It is present in Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, and the 26H1 variant; and Windows Server editions 2019, 2022, and 2025, including Server Core installations.

The CVSS score of 6.5 indicates moderate severity, and the EPSS score is not available, so the current probability of exploitation cannot be quantified. The flaw is listed as not in the CISA KEV catalog. The attack requires an authorized user with access to the Hyper‑V host and the ability to send crafted data across the network that is processed by the vulnerable component. Once triggered, the attacker can leak memory contents to the network peer, potentially exposing sensitive data or system details.