Microsoft Hyper-V CVE-2026-83671

Exploitation requires the Hyper-V role/feature to be enabled and the attacker to already possess low-privileged local code execution, realistically within a Hyper-V guest virtual machine on an affected Windows host. The vector is local only (AV:L) with no user interaction; it does not work remotely or against hosts without the Hyper-V virtualization stack active. Limiting factors: the attacker must first obtain a foothold inside a guest, hold at least low privileges (PR:L), and the host must be running an unpatched affected build (e.g., Windows 11 24H2 <10.0.26100.9711, Windows Server 2022 <10.0.20348.5761, Windows Server 2025 <10.0.26100.33650). Impact is confined to information disclosure - no code execution or integrity/availability loss directly.

This is a moderate-severity, local information-disclosure flaw (CWE-125 out-of-bounds read) in Windows Hyper-V, and the signals are consistent in pointing to limited real-world urgency rather than an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 6.5) indicates an attacker already executing code locally with low privileges - realistically inside a guest VM - can read memory across the virtualization boundary (scope change, S:C), yielding high confidentiality impact but no integrity or availability effect. CISA's SSVC framework corroborates low priority: Exploitation=none (no observed exploitation), Automatable=no, and Technical Impact=partial. No CISA KEV listing and no public exploit are indicated in the data, so this is 'no public exploit identified at time of analysis.' No EPSS score was provided, so exploitation probability cannot be quantified. The signals do not conflict: a local-only vector, required low-privilege authentication, no automatable exploitation, and no evidence of in-the-wild use all align toward patch-in-normal-cycle priority. The main value is as a potential building block in a guest-to-host escape chain or for leaking host/hypervisor memory to defeat ASLR, which raises its interest to attackers targeting virtualization/cloud tenancy even though standalone impact is read-only.

An attacker who already has low-privileged code execution inside a Hyper-V guest VM triggers the out-of-bounds read to leak adjacent memory contents belonging to the host or hypervisor, potentially exposing secrets or addresses useful for defeating memory protections. Because the scope is changed, the disclosed data can cross the VM security boundary. No public exploit code is identified at time of analysis, and exploitation requires prior local access to a guest.