Windows Hyper-V CVE-2026-42972

Exploitation requires an authenticated local session on the affected Windows system with at least low-level privileges (PR:L per CVSS vector), meaning the attacker must already have code execution or an interactive logon on the host. Hyper-V must be installed and active on the target - systems where the Hyper-V role or feature is not enabled are not affected. No user interaction is required once local access is established. Exploitation is bounded to the local machine (S:U, AV:L); remote unauthenticated exploitation is not possible. Limiting factors include: the requirement for prior local access, the need for Hyper-V to be present and running, and the absence of any network-exploitable attack path. In standard enterprise workstation environments where Hyper-V is not enabled by default, the exposure is significantly reduced.

The CVSS 5.5 medium score is consistent with the attack profile: local access (AV:L), low complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high confidentiality impact (C:H) with no integrity or availability impact. The local attack vector is the primary limiting factor - network-remote exploitation is not possible per CVSS. EPSS data was not provided; given no KEV listing and no public exploit, opportunistic mass exploitation is unlikely. However, in multi-tenant Hyper-V deployments (cloud infrastructure, VDI environments, hosted services), a compromised low-privileged VM user or guest process reading sensitive host or cross-VM data could represent a meaningful confidentiality breach. No conflicting signals are present between CVSS and the description - both consistently indicate local authenticated exploitation. The broad affected version range (20+ SKUs from Server 2012 to Windows 11 26H1) amplifies the patch urgency for environments running legacy server OSes.

A low-privileged user or attacker with an established local session on a Hyper-V host - such as a RDP user, a service account process, or a compromised VM guest with foothold on the host - invokes a Hyper-V API or triggers a code path in the Hyper-V component that improperly returns sensitive memory contents. The attacker reads the disclosed data (potentially hypervisor memory, VM state, or cryptographic material) to support lateral movement or privilege escalation. No public exploit exists at time of analysis, so exploitation currently requires attacker-developed tooling.