Windows Hyper-V EUVD-2026-100058

Exploitation requires the attacker to already have low-privileged authenticated code execution inside a Hyper-V guest virtual machine on an affected host (AV:L, PR:L); it is not remotely reachable without that foothold. The high attack complexity (AC:H) indicates a further limiting condition - likely a race window or precise heap-memory state that must be met - so exploitation is not deterministic. The scope change (S:C) means a successful overflow crosses the VM isolation boundary into the host/parent partition. Limiting factors: local-only access, prior guest-VM privileges needed, no user interaction on the host side, and only unpatched builds below the fixed versions (e.g., Server 2025 <10.0.26100.33650, Windows 11 24H2 <10.0.26100.9711) are vulnerable.

This is a genuine but second-tier priority rather than an emergency. The CVSS 3.1 base score of 7.8 (High) is driven heavily by the scope change (S:C) and total CIA impact (C:H/I:H/A:H), consistent with a Hyper-V guest-to-host escape where code executes in the privileged host partition. However, the exploitability metrics temper this: attack vector is local (AV:L), attack complexity is high (AC:H, implying a race condition or precise heap-state requirement), and some privilege is required (PR:L). CISA's SSVC framework corroborates a non-urgent posture: Exploitation=none, Automatable=no, with Technical Impact=total - meaning severe consequence per exploitation but no evidence of active or scalable attacks. There is no KEV listing and no POC referenced in the input, so exploitation status is 'no public exploit identified at time of analysis.' EPSS is not provided, so widespread-exploitation probability cannot be quantified. Net: a serious virtualization-boundary flaw worth patching in Hyper-V hosts on a normal prioritized cycle, but the high complexity and lack of any exploitation signal argue against treating it as drop-everything.

An authenticated, low-privileged attacker already executing code inside a Hyper-V guest VM triggers a heap-based buffer overflow in the virtualization stack, corrupting host-side memory to run arbitrary code in the parent partition (S:C escape). Because AC:H applies, success likely depends on winning a race or grooming a specific heap layout, so reliable exploitation requires effort. No public exploit code is referenced at time of analysis.