Windows VMSwitch EUVD-2026-99129

Exploitation requires the Hyper-V VMSwitch (virtual switch) component to be present and in use, which means the Windows host must have the Hyper-V role/virtual networking enabled - it does not affect Windows systems without Hyper-V virtual switching. The attacker must already hold valid low-privilege local access (PR:L, AV:L); this is not remotely exploitable by an unauthenticated attacker. High attack complexity (AC:H) further limits practical exploitation: a specific race/state condition must be met to trigger the NULL pointer dereference reliably. Impact is confined to availability (service crash); there is no confidentiality or integrity loss. These factors - local authenticated access, Hyper-V-only applicability, and timing-dependent triggering - substantially constrain real-world risk.

This is a moderate-severity, low-priority denial-of-service issue rather than an urgent threat. All exploitation signals point the same direction and are mutually consistent: the CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H, base 5.6) requires local access, authenticated privileges (PR:L), and high attack complexity (AC:H), with impact limited purely to availability (C:N/I:N/A:H). CISA's SSVC framework corroborates this - Exploitation: none, Automatable: no, Technical Impact: partial - indicating no observed exploitation and no reliable mass-automation path. The vulnerability is NOT in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The one notable signal is the scope change (S:C), meaning a crash in the VMSwitch component can affect resources beyond the attacker's own security context (e.g., the Hyper-V host or co-resident guests), which is why an otherwise local, low-privilege DoS still scores 5.6. No signals conflict; the consistent picture is a genuine but low-priority bug best handled through routine patching.

An authenticated, low-privileged user on a Windows/Hyper-V host (or potentially a guest with network paths through the virtual switch) sends specially crafted traffic or operations that reach the VMSwitch code path and trigger a NULL pointer dereference, crashing the component. Because the scope is changed (S:C), the resulting denial of service can disrupt the host networking stack and co-located virtual machines, not just the attacker's own context. No public proof-of-concept is referenced, and the high attack complexity (AC:H) implies a specific timing or state condition must be met to reliably trigger the fault.