Windows Hyper-V EUVD-2026-44271

Exploitation requires an authenticated foothold able to interact with the Hyper-V VMSwitch driver - in practice, code execution inside a guest VM or another low-privilege context on a host running the Hyper-V virtual switch (CVSS PR:L confirms a low privilege level is needed, not unauthenticated access). The affected component is specifically the VMSwitch virtual network switch, so hosts without the Hyper-V role or virtual switching enabled are not exposed. Limiting factors: the attacker must already reach a guest/low-priv context (no PR:N), and reliable use-after-free exploitation typically requires winning a memory-reuse race despite the AC:L rating; no user interaction is required (UI:N).

The signals are largely consistent and point to a genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) describes a network-reachable, low-complexity, low-privilege attack with no user interaction, full CIA impact, and a scope change - the maximal profile for an EoP short of PR:N, which drives the 9.9 score. Tempering factors: PR:L means the attacker must first hold a foothold in a guest VM (or otherwise reach VMSwitch), and use-after-free primitives in the kernel typically require winning a race or grooming allocations, so real-world weaponization is non-trivial despite the AC:L rating. No EPSS score, POC, or KEV listing is supplied, so exploitation is currently theoretical rather than observed. One tension worth verifying with the vendor: the description frames this as elevation of privilege 'over a network,' yet Hyper-V VMSwitch attacks are usually driven from a guest partition - confirm whether AV:N reflects true remote reachability or the guest-to-host network path.

An attacker who has already compromised or been granted access to a low-privilege guest VM on a Hyper-V host sends crafted virtual network operations that trigger the use-after-free in vmswitch.sys, grooming kernel memory to reclaim the freed object with attacker-controlled data. Successful exploitation corrupts host-partition kernel memory and escalates from guest context to SYSTEM-level control of the host, breaking VM isolation. No public exploit is identified at time of analysis, and the kernel race/grooming involved makes reliable exploitation non-trivial despite the low complexity rating.