Windows Hyper-V CVE-2026-97813

Exploitation requires the Windows Hyper-V role/feature to be present and reachable, plus pre-existing low-level privileges (PR:L) - the attacker must already be an authenticated/authorized principal, such as a user within a guest VM or a low-rights account that can reach the Hyper-V service over the network; it is not exploitable by a fully anonymous remote attacker. No user interaction is needed (UI:N) and attack complexity is low (AC:L). Impact is limited to confidentiality (C:H, I:N, A:N): the attacker can read leaked memory but cannot modify data or disrupt service. The authentication requirement and read-only outcome are the primary limiting factors; hosts without the Hyper-V role enabled are not affected.

This is a moderate-severity information-disclosure flaw, not a top-tier priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable, low-complexity attack that requires existing low-level privileges (PR:L) and yields high confidentiality impact but no integrity or availability impact - consistent with memory disclosure from a heap over-read rather than code execution. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or weaponization; exploitation status is 'no public exploit identified at time of analysis.' The requirement for prior authenticated access (PR:L) plus the read-only impact meaningfully lowers real-world risk versus an unauthenticated RCE, so despite the 'network' vector this is better treated as a routine patch-cycle item than an emergency. One signal to verify: Hyper-V flaws often involve a guest-to-host boundary, yet the metrics show S:U (scope unchanged) - if Microsoft's advisory describes cross-boundary disclosure, the scope assessment should be re-checked with the vendor. EPSS/KEV/POC data being absent is expected for a freshly published Microsoft advisory and is not itself a red flag.

An attacker who already holds low-privileged authenticated access in a Hyper-V environment (for example, a user on a guest VM or a low-rights account able to reach the Hyper-V service over the network) sends crafted input that triggers a heap-based buffer over-read. The resulting out-of-bounds read leaks adjacent heap memory - potentially containing sensitive host or other-tenant data - back to the attacker over the network. No public exploit code is known, and the low-complexity (AC:L) vector means a working exploit, if developed, would be reliable.