Windows Hyper-V EUVD-2026-99928

Exploitation requires the Hyper-V role/feature to be enabled on the target Windows host, and the attacker must already possess local, authorized low-privileged access (PR:L) - plausibly from within a guest VM given the changed scope (S:C) where a guest crashes the host. No user interaction is needed (UI:N). Limiting factors: the attack is local only (AV:L), so there is no remote network vector; it requires valid existing access rather than anonymous reach; and hosts without the Hyper-V role enabled are not exposed. Impact is confined to availability (A:H) - a denial of service via host/hypervisor crash - with no confidentiality or integrity consequences.

This is a moderate, defensively-prioritized issue rather than an urgent emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H, base 6.5) describes a local, low-complexity, low-privilege availability-only flaw with no confidentiality or integrity impact; the scope change (S:C) is the notable element, indicating a low-privileged actor in one security context (e.g., a Hyper-V guest) can crash a different context (the host/hypervisor). CISA's SSVC framework aligns with a low-urgency reading: Exploitation=none (no observed exploitation), Automatable=no, and Technical Impact=partial. No EPSS score was provided in the input, and there is no KEV listing and no public exploit referenced, so the exploitation status is 'no public exploit identified at time of analysis.' All signals are internally consistent - there is no conflict between a network CVSS and a local description here, as both agree the vector is local. The primary risk is a malicious or compromised guest VM denying service to the host and co-located tenants, which is meaningful in multi-tenant virtualization but requires existing local authorized access, keeping real-world risk modest. Note: no EPSS probability was supplied, so widespread-exploitation likelihood cannot be quantified from the data.

An attacker with low-privileged authorized access inside a Hyper-V guest VM issues a crafted operation that triggers a null pointer dereference in the Hyper-V virtualization stack, crashing the hypervisor host. Because the CVSS scope is changed (S:C), this denies service not just to the attacker's own VM but to the host and other guests running on it. No public exploit code is identified at time of analysis, and exploitation requires pre-existing local access.