Windows Hyper-V CVE-2026-61368

Exploitation requires all of the following to be present: the Hyper-V role or feature must be installed and running on the target Windows system (the vulnerability does not affect systems where Hyper-V is absent or disabled); the attacker must hold a low-privileged authenticated account with local interactive logon rights on the Hyper-V host (PR:L per CVSS); and some form of user interaction must occur on the system (UI:R per CVSS), preventing fully automated exploitation. Remote unauthenticated exploitation is not possible - the local-only attack vector (AV:L) is a hard constraint. Exploitation is further limited to information disclosure only; no code execution, privilege escalation, or denial-of-service outcome is described. These conditions collectively mean that guest VM operators or unprivileged domain users with logon rights to Hyper-V hosts represent the realistic attacker population.

The CVSS base score of 5.0 (Medium) is consistent with the described exploitation conditions: the attack vector is strictly local (AV:L), requires only low privileges (PR:L), and demands user interaction (UI:R), meaning fully automated or remote exploitation is not possible. The scope is unchanged (S:U) and impact is limited to confidentiality (C:H/I:N/A:N), ruling out code execution or denial-of-service as outcomes. No EPSS data was supplied, and the absence of a KEV listing means active exploitation is neither confirmed nor strongly suggested by external intelligence. No public proof-of-concept exploit has been identified. Given these constraints, even a mid-sized municipal IT team in bytom should treat this as a standard patch-cycle priority rather than an emergency response event, provided local user access to Hyper-V hosts is already restricted. The primary elevated-risk scenario is multi-tenant virtualization environments where a low-privileged guest operator could leverage the disclosure to extract host or cross-VM sensitive data, increasing the effective impact beyond what the raw CVSS score implies for isolated deployments.

A low-privileged user with an authenticated local session on a Windows host running Hyper-V performs a specific interaction - such as invoking a Hyper-V management API or triggering a guest VM interface operation - that causes a heap-based buffer overflow in a Hyper-V component. The overflow allows the attacker to read adjacent heap memory, which may contain sensitive host memory contents or data from other guest VMs, and exfiltrate that information. No public exploit code has been identified, making this scenario most relevant to targeted insider or post-compromise threat actors who already have local access.