Windows Hyper-V CVE-2026-70248

Exploitation requires the Hyper-V role to be enabled on the host and the attacker to hold low-privileged authenticated access within a guest VM (PR:L) with local access to the host/hypervisor interface (AV:L) - it is not remotely reachable over a network. The impact is limited to availability (DoS); there is no confidentiality or integrity exposure. Limiting factors: hosts not running the Hyper-V role are unaffected, and the realistic threat is concentrated in multi-tenant or shared-virtualization deployments where untrusted parties control guest VMs - a single-tenant host where all guests are trusted faces negligible practical risk. No user interaction is required (UI:N), and no public exploit code has been identified.

This is a genuinely moderate, not high, priority issue despite the 6.5 CVSS. All signals align toward low real-world urgency: the CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) describes a locally-exploitable, authenticated denial-of-service with no confidentiality or integrity impact - the 6.5 score is inflated only by the scope change (S:C), reflecting that a Hyper-V guest can crash the host. CISA's SSVC framework reinforces low urgency: Exploitation=none, Automatable=no, Technical Impact=partial. There is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active exploitation. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The signals are consistent rather than conflicting: a local, authenticated, availability-only flaw in a virtualization component with no known exploitation. The one meaningful amplifier is the scope change - a malicious or compromised guest VM can deny service to the host and therefore to co-tenant VMs, which matters in multi-tenant or consolidated virtualization environments. Overall this is a patch-in-normal-cycle issue, prioritized higher only where Hyper-V hosts carry untrusted or multi-tenant guests.

An attacker with low-privileged authenticated access inside a Hyper-V guest VM (AV:L, PR:L) issues a crafted operation that triggers a null pointer dereference (CWE-476) in the Hyper-V component. Because the scope changes (S:C), the resulting crash denies service beyond the guest, taking down the host and thereby other co-located VMs. No public exploit code has been identified at time of analysis, and no user interaction is required (UI:N).