Windows Hyper-V CVE-2026-54129

Exploitation requires the Hyper-V role/virtualization stack to be present and the attacker to already possess local, authenticated access at a low privilege level (CVSS PR:L, AV:L) - this is a local privilege-escalation primitive, not remotely reachable. The limiting factors that reduce realistic risk are: the attacker must first obtain code execution on the host as an existing (even unprivileged) user, the target must have the vulnerable Hyper-V component enabled, and no network vector or automation path exists (SSVC Automatable: no). No user interaction is needed once local access is obtained (UI:N), and complexity is low (AC:L), so on affected, Hyper-V-enabled hosts an already-present local user can reliably attempt escalation.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 High) describes a low-complexity local attack requiring low privileges and no user interaction, yielding total impact within the vulnerable system's scope. Corroborating signals largely agree that this is a serious-but-not-emergency issue: CISA SSVC rates Exploitation 'none', Automatable 'no', and Technical Impact 'total', while EPSS is low at 0.20% (10th percentile), and there is no KEV listing and no public exploit identified at time of analysis. The signals are internally consistent - a local EoP with total impact but no automation path and no observed exploitation. The primary caveat is that use-after-free kernel bugs of this class are historically attractive for reliable local privilege escalation and are frequently chained after initial code execution, so the low EPSS reflects current absence of public exploitation rather than intrinsic difficulty. No conflicting data was observed; the local vector is consistent with the description's 'elevate privileges locally' wording.

An attacker who has already gained a low-privileged foothold on a Hyper-V-enabled host - for example via phishing, a compromised service account, or an untrusted user on a shared server - runs a crafted program that triggers the use-after-free in the Hyper-V component to corrupt kernel memory and elevate to SYSTEM. No user interaction is required and attack complexity is low, but the attacker must already be able to execute code locally; no public exploit is identified at time of analysis.