Windows Hyper-V CVE-2026-50485

Exploitation requires two concurrent prerequisites grounded in the CVSS vector. First, the attacker must have high-privilege access (PR:H) - the description explicitly uses the term 'authorized attacker', confirming that unauthenticated exploitation is not possible. Second, the attacker must be positioned on the adjacent network segment (AV:A), meaning direct Layer-2 or equivalent network adjacency to the Hyper-V host; remote exploitation from the internet is not viable. The attack requires no user interaction (UI:N) once those conditions are met. Exploitation is limited to a denial-of-service impact only - no confidentiality or integrity impact is possible per C:N/I:N. Defenders should note that the adjacency plus high-privilege requirements significantly reduce realistic attacker population to privileged insiders or post-compromise lateral movers with elevated rights.

The CVSS base score of 4.5 (Medium) accurately reflects the constrained threat model. AV:A (adjacent network) restricts exploitation to attackers physically or logically co-located on the same network segment - direct internet exposure is not applicable. PR:H (high privileges required) further narrows the field to attackers who are already authorized and operating with elevated credentials on the target system or network. S:U (unchanged scope) and C:N/I:N confirm no lateral movement or data exfiltration path exists through this vulnerability; the sole impact is availability (A:H). No EPSS score was provided in the input, and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation. No POC code has been disclosed. The combination of adjacency requirement and high-privilege prerequisite places real-world exploitation risk well below what the A:H metric alone might suggest - this is not a remotely exploitable, unauthenticated path. Priority is moderate for environments running Hyper-V on exposed internal network segments where privileged insider or lateral-movement scenarios are plausible.

An attacker who has already obtained high-privilege credentials on the target network (via lateral movement or insider access) sends a specially crafted network message to the Hyper-V subsystem of an adjacent Windows host. The malformed input triggers a buffer over-read in Hyper-V's network handling code, causing an unhandled memory access fault that crashes or hangs the hypervisor, taking all hosted virtual machines offline until the host is restarted.