Host Guardian Service EUVD-2026-99758

Exploitation requires that the target server has the Windows Host Guardian Service (HGS) role installed and running and that its network endpoint is reachable by the attacker; HGS is an optional role used only in guarded-fabric/shielded-VM deployments, so systems without this role are not affected. No authentication is required (PR:N) and no user interaction (UI:N), and the attack works over the network (AV:N) at low complexity (AC:L). The limiting factors are the narrow deployment footprint of the HGS role and the impact ceiling: successful exploitation causes only denial of service (A:H, C:N/I:N) - service disruption to attestation/key-protection for guarded hosts - with no code execution or data exposure. Patched builds (e.g. Server 2025 ≥10.0.26100.33650, Server 2022 ≥10.0.20348.5761, 2016/2019 and Windows 10 1607/1809 equivalents) remove the condition.

This is a genuine but bounded issue best treated as a medium-priority patch rather than an emergency. The CVSS 7.5 is driven entirely by availability (A:H) with no confidentiality or integrity impact (C:N/I:N), so the ceiling is denial of service, not compromise. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes remote, unauthenticated, low-complexity reachability, which is the main escalator. Countervailing signals keep real-world urgency moderate: CISA SSVC lists Exploitation as 'none' and Technical Impact as only 'partial', there is no CISA KEV listing and no public exploit identified, and EPSS was not provided. SSVC does flag Automatable: yes, meaning a working exploit could be scripted at scale, so the risk is latent rather than realized. The signals are internally consistent (network DoS, scriptable, not yet exploited); the principal gap is the absence of an EPSS probability to quantify likelihood. Net: patch on a normal-to-expedited cycle, prioritizing internet- or untrusted-network-reachable Host Guardian Service deployments.

An attacker with network reachability to a server running the Windows Host Guardian Service role sends a crafted network message that overflows a stack buffer in the service, crashing it. Because Host Guardian Service provides attestation and key-protection for guarded Hyper-V fabrics, its outage can prevent shielded VMs from starting or being unlocked. No public exploit code has been identified at time of analysis, and the flaw yields denial of service only (no code execution or data disclosure).