Windows Hyper-V CVE-2026-88071

Requires the Hyper-V role/component to be present and enabled on the target Windows host (Windows 11 23H2/24H2/25H2/26H2 or Windows Server 2022/2025, including Server Core, below the patched builds listed in EUVD). The attacker must already hold local, authenticated/authorized execution (PR:L) on that host - this is a privilege-escalation primitive, not a remote entry point. Limiting factors: no remote exploitation (AV:L), an existing foothold is mandatory, UI:N means no victim interaction is needed, and hosts without the Hyper-V role are not exposed; CISA SSVC rates it non-automatable and reports no known exploitation.

This is a genuine but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-complexity elevation-of-privilege flaw requiring an already-authenticated/authorized attacker - not a remotely reachable issue, so it is a post-compromise escalation primitive rather than an initial-access vector. The CISA SSVC framework corroborates a restrained posture: Exploitation=none (no observed or public exploitation), Automatable=no (consistent with a local EoP that cannot be mass-scanned/wormed), but Technical Impact=total (matching the C:H/I:H/A:H full-system compromise if triggered). No EPSS score was provided in the input, and KEV status is not present, so this is NOT a confirmed actively-exploited bug; there is no public exploit identified at time of analysis. The signals are internally consistent (local EoP, total impact, no known exploitation), so there is no contradiction to flag - the main caveat is the input Tag 'Information Disclosure', which conflicts with the description of a double free enabling privilege elevation; the vulnerability class is elevation of privilege, not information disclosure. Bottom line: patch on normal-to-expedited cadence for Hyper-V hosts, but this does not carry the emergency urgency of a network-facing or actively-exploited flaw.

An attacker who already has the ability to run low-privileged code on a Windows host with the Hyper-V role enabled (or within a context able to reach the vulnerable Hyper-V component) triggers the double free (CWE-415) to corrupt kernel memory and escalate to SYSTEM. Because the CVSS vector is AV:L/AC:L, exploitation is local and low-complexity but requires an existing foothold; no public exploit code has been identified at time of analysis.