Windows Hyper-V CVE-2026-72961

Exploitation requires the attacker to hold administrator-level (high-privilege) access within a Hyper-V guest virtual machine running on an affected Windows build. Hyper-V must be enabled and running on the target host - it is not installed or active by default on all Windows editions (typically requires explicit enablement on workstation SKUs, but is standard on Server SKUs). The attack is local (AV:L), meaning no network path to the Hyper-V component is needed; the malicious activity originates from within the guest VM. What limits exploitation: the PR:H prerequisite means unprivileged guest users cannot directly trigger the flaw; the attacker must first gain guest admin rights through another means. No user interaction on the host side is required once the attacker has guest-admin access.

The CVSS 8.2 score reflects a locally-triggered, high-privilege-required exploit with scope change to the host - a profile typical of VM escape primitives. PR:H limits opportunistic exploitation: the attacker must already hold administrator or operator-level access inside the Hyper-V guest before triggering the flaw. However, in multi-tenant or cloud-adjacent Hyper-V deployments, gaining guest-admin access is a realistic first stage, making the post-exploitation impact (full host C:H/I:H/A:H) extremely severe. No EPSS score was provided and no CISA KEV listing exists, suggesting no confirmed active exploitation at time of analysis. The absence of a public POC and the PR:H prerequisite keeps real-world risk below the raw severity headline, but the guest-to-host scope change makes this a high-priority patch target for any organization running Hyper-V in shared or cloud environments. Note: the description states 'out-of-bounds read' while CWE-122 (Heap-based Buffer Overflow) and the 'Heap Overflow' tag describe a write primitive - this discrepancy is common in Microsoft advisories where the read is the triggering condition and overflow is the exploitable consequence, but exact mechanics are not independently confirmed.

An attacker who has obtained administrative access inside a Hyper-V guest VM sends a crafted input to the vulnerable Hyper-V component that triggers a heap-based buffer overflow, enabling an out-of-bounds read of hypervisor memory. By leveraging the memory disclosure and corruption to manipulate host-level data structures, the attacker escapes the guest isolation boundary and achieves code execution with elevated privileges on the underlying Windows host - compromising all other VMs and the host operating system. No public exploit code has been identified at time of analysis.