Windows Hyper-V EUVD-2026-35517

Exploitation requires the Hyper-V role or Hyper-V Platform feature to be enabled on the target Windows or Windows Server host, plus local access with high privileges (CVSS PR:H) - most plausibly administrative access within a guest VM. The attack does not require user interaction (UI:N), so no operator action on the host console is needed once the attacker has the prerequisite guest-admin foothold. Note the description's wording 'unauthorized attacker' conflicts with the CVSS PR:H requirement - Microsoft's MSRC entry should be consulted to confirm whether 'unauthorized' refers to lacking host privileges while still requiring guest privileges. Single-tenant hosts where guest administrators are already trusted face substantially reduced realistic risk.

The CVSS vector AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H paints a nuanced picture: local attack vector with high privileges required limits casual exploitation, but the scope change combined with high impact across CIA triad signals a hypervisor escape - historically the most consequential class of Hyper-V bugs. No EPSS, KEV, or POC data was provided, so exploitation probability cannot be quantitatively assessed, but Microsoft's classification of these issues as remote code execution despite an AV:L vector typically reflects a guest VM (with admin in guest) breaking into the host. This is a high-priority patch for multi-tenant virtualization environments (Azure, hosted VDI, server consolidation) where guest administrators are untrusted, but lower priority for single-tenant hosts where the attacker would already need host admin. Note: the description says 'unauthorized attacker' which conflicts with PR:H in the vector - verify with Microsoft whether the privilege requirement applies within a guest VM versus the host.

An attacker who has obtained administrative privileges inside a guest VM (for example, via a tenant account on a hosted virtualization platform or through prior compromise of a guest OS) issues crafted synthetic device or VMBus operations that trigger the out-of-bounds read in the Hyper-V stack. The resulting memory disclosure or corruption is chained to execute code in the host partition, escaping VM isolation and gaining control over co-located tenants.