Microsoft Hyper-V EUVD-2026-99494

Requires the Hyper-V role/feature to be installed and enabled on the host, and the attacker must already hold high privileges (PR:H) within a guest VM; exploitation is local only (AV:L) with no user interaction (UI:N). Limiting factors: Windows systems without Hyper-V enabled are not exposed, and the PR:H prerequisite means the attacker needs prior privileged foothold inside a guest, confining this to post-compromise escalation and VM-boundary escape rather than remote or unprivileged attack. Affected builds are specific Windows 10/11, Windows Server 2022, and Windows Server 2025 versions below the patched builds listed in EUVD-2026-99494; fully patched hosts are not vulnerable.

Signals are mixed and point to a serious but not emergency-grade issue. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:C, 8.2 HIGH) describes a local attack requiring high existing privileges, but with a changed scope and total impact - consistent with a Hyper-V guest-to-host escape/EoP where a privileged guest process reaches the host. CISA's SSVC framework reinforces a measured priority: Exploitation=none and Automatable=no, but Technical Impact=total, so the ceiling is severe while current exploitation is not observed. There is no CISA KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided in the input (missing data - cannot gauge statistical exploitation probability). The PR:H requirement is the dominant mitigating factor: an attacker must already control a privileged context inside a guest VM, which bounds this to post-compromise lateral/vertical movement rather than initial access. Note a data tension worth verifying: CWE-125 (out-of-bounds read) and the description ('out-of-bounds read', 'information disclosure' tag) imply a confidentiality/leak primitive, yet the vendor vector asserts I:H/A:H - the full integrity/availability impact likely reflects the ultimate EoP outcome rather than the read primitive itself. Bottom line: a legitimate patch-soon priority for virtualization hosts, not a drop-everything internet-facing emergency.

An attacker who has already gained high-privilege code execution inside a Hyper-V guest VM triggers an out-of-bounds read in the Hyper-V virtualization stack to leak host-side memory, then leverages the disclosed data to escalate privileges and cross the VM-to-host security boundary. Because the CVSS vector is local (AV:L) with low complexity (AC:L) but requires high privileges (PR:H), this is a realistic post-compromise escalation step in multi-tenant or lab virtualization environments. No public exploit identified at time of analysis.