Windows Hyper-V CVE-2026-50680

Exploitation requires the Hyper-V role/feature to be present and enabled on the target Windows host, and the attacker must already have authenticated local access with at least low privileges (PR:L) to reach the vulnerable Hyper-V code path - this is not a remote or unauthenticated vector (AV:L). No user interaction is required (UI:N) and attack complexity is low (AC:L), so once a foothold exists exploitation is straightforward. Limiting factors that reduce real-world risk: the need for prior local code execution as an authenticated principal, the requirement that Hyper-V be enabled (hosts without the virtualization role are not exposed), and the scope-unchanged rating indicating no confirmed crossing into other security boundaries. SSVC rates exploitation as none and non-automatable, further narrowing likely use to targeted scenarios.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a local, low-complexity attack requiring low privileges and no user interaction, with total impact to confidentiality, integrity, and availability - consistent with SSVC's 'Technical Impact: total'. However, the other exploitation signals temper urgency: SSVC lists Exploitation as 'none' and Automatable as 'no', EPSS is only 0.36% (28th percentile), and there is no public exploit identified at time of analysis. This is a genuine escalation primitive worth patching on the normal cycle rather than an emergency: the scope is unchanged (S:U), so it does not itself indicate a hypervisor escape crossing a trust boundary, and the local, authenticated prerequisite plus the non-automatable, low-EPSS profile argue for targeted rather than widespread exploitation. No conflicting signals were found in the data; all indicators consistently point to a locally exploitable EoP.

A low-privileged but authenticated user already able to run code on a Hyper-V-enabled host invokes the vulnerable Hyper-V code path with crafted input that overflows a heap buffer, corrupting adjacent heap structures to hijack execution in a privileged context and escalate to SYSTEM. Because the CVSS vector is local and low-complexity (AV:L/AC:L) with no user interaction, the attack is reliable once local access is obtained, though no public exploit code has been identified at time of analysis.