Microsoft Hyper-V EUVD-2026-99962

Exploitation requires the Hyper-V role/feature to be enabled on the target Windows host and the attacker to already possess authenticated low-privileged access inside a guest VM (PR:L, AV:L) - there is no remote or network-facing attack surface. The primary limiting factor is this prerequisite foothold: hosts without Hyper-V enabled, or single-tenant deployments where no untrusted guest exists, are not realistically exposed. No user interaction is needed (UI:N) and attack complexity is low (AC:L), so once an attacker is inside a guest the barrier to triggering the overflow is minimal. Affected builds span Windows 10/11 and Windows Server 2016 through 2025 below the fixed revisions listed in EUVD; systems patched to those revisions are not vulnerable.

This is a credible high-priority patch target, but not an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) describes a low-complexity, locally-exploitable flaw requiring low privileges but no user interaction, with a scope change and total impact on confidentiality, integrity, and availability - a classic signature of a Hyper-V guest-to-host escape where an authorized attacker inside a guest VM compromises the host. SSVC reinforces this: Technical Impact is 'total' (consistent with C:H/I:H/A:H and S:C), but Exploitation is 'none' and Automatable is 'no', meaning CISA sees no observed exploitation and the flaw is not amenable to mass/automated attack (it needs a foothold in a guest). There is no CISA KEV listing and no POC was provided, so this is no public exploit identified at time of analysis. No EPSS score was supplied, so probabilistic exploitation likelihood cannot be factored in - this is a missing signal. The signals are internally consistent rather than conflicting: high severity driven by impact and scope change, offset by the local vector and the requirement for existing guest access, which limits real-world reach to multi-tenant or shared virtualization environments.

An attacker who already controls a low-privileged guest virtual machine (for example a tenant on a shared Hyper-V host or a compromised VM) sends crafted input to the Hyper-V virtualization stack, triggering a heap-based buffer overflow (CWE-122) that corrupts host memory. Because the CVSS scope is changed (S:C), successful exploitation breaks out of the guest and executes arbitrary code on the host with full compromise of confidentiality, integrity, and availability. No public exploit code was identified at the time of analysis, and the attack requires pre-existing guest access rather than remote network reach.