Windows Hyper-V EUVD-2026-100371

Exploitation requires the attacker to already hold an authorized, low-privileged execution context inside a Hyper-V guest virtual machine running on a host with the Hyper-V role enabled (AV:L, PR:L). No user interaction is needed (UI:N) and attack complexity is low (AC:L). The limiting factors are that the target must actually be running Hyper-V with guest VMs, and the attacker must first obtain authenticated code execution within a guest - this is not a remote, unauthenticated, network-reachable flaw. The Changed scope (S:C) indicates the impact crosses the guest/host security boundary to compromise the hypervisor host.

This is a genuine high-priority issue rather than a high-CVSS-but-low-risk one, primarily because the CVSS:3.1 vector carries S:C (scope change) combined with C:H/I:H/A:H, which for a Hyper-V memory-corruption bug almost certainly denotes a guest-to-host escape - a low-privileged attacker inside a guest VM breaking into the host's security boundary. The vector is internally consistent: AV:L and PR:L confirm the attacker must already have authenticated code-execution ability inside a guest, AC:L indicates reliable triggering, and UI:N means no victim interaction is needed. The CVSS vector and the textual description ('authorized attacker to execute code locally') agree, so there is no AV conflict to flag. However, several real-world risk signals are simply absent from the input: no EPSS exploitation-probability score was provided, the vulnerability is not listed in CISA KEV, and no public proof-of-concept is referenced - therefore there is no public exploit identified at time of analysis and no evidence of active exploitation. Note also that the Tags include 'Denial Of Service' even though the description and C:H/I:H/A:H impact describe code execution; treat the DoS label as incomplete rather than authoritative. Net: prioritize patching on Hyper-V hosts because the impact (hypervisor escape) is severe and the barrier (local guest access) is modest, but current exploitation likelihood is unquantified due to missing EPSS/KEV/POC data.

An attacker who already controls a low-privileged, authorized context inside a Hyper-V guest VM (e.g. a tenant on shared virtualization infrastructure) triggers a use-after-free in the Hyper-V virtualization stack to corrupt memory on the host. Because the CVSS scope is Changed, successful exploitation breaks out of the guest and executes attacker-controlled code on the host, compromising all co-resident VMs. No public exploit code is identified at time of analysis, so this scenario reflects the vector-implied capability rather than an observed attack.