What is the CVSS score of CVE-2026-21248?

CVE-2026-21248 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2026-21248?

A high-severity heap buffer overflow in Windows Hyper-V allows authenticated attackers with local access to execute arbitrary code, potentially compromising virtualized environments and hosted…. A patch is available.

Is there a public PoC exploit available for CVE-2026-21248?

Yes, a public proof-of-concept exploit is available for CVE-2026-21248. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-21248?

Within 24 hours: Inventory all Windows Hyper-V deployments and identify systems with untrusted user access; disable guest VM access for non-essential accounts. Within 7 days: Implement strict role-based access controls limiting Hyper-V administrative privileges, enable Enhanced Session Mode restrictions, and segment Hyper-V hosts from general user networks. Within 30 days: Monitor for vendor patch release and prepare deployment; conduct security assessment of all Hyper-V guest VMs for lateral movement risk.

Windows CVE-2026-21248

HIGH

Heap-based Buffer Overflow (CWE-122)

2026-02-10 secure@microsoft.com

Windows Hyper-V Buffer Overflow Heap Overflow Windows Server 2025 Windows 10 1809 Windows 10 21h2 Windows 10 1607 Windows 11 24h2 Windows Server 2022 23h2 Windows 11 23h2 Windows 11 25h2 Windows Server 2016 Windows Server 2022 Windows Server 2019 Windows 10 22h2 Microsoft

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:02 vuln.today

CVE Published

Feb 10, 2026 - 18:16 nvd

HIGH 7.3

DescriptionCVE.org

Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.

AnalysisAI

Heap overflow in Windows Hyper-V enables authenticated local users to achieve arbitrary code execution with high privileges on affected Windows and Windows Server systems. An attacker with local access and user-level permissions can trigger memory corruption through user interaction to compromise system integrity and confidentiality. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Attacker with local account logs in

Delivery

Opens Hyper-V management interface

Exploit

Sends crafted input to VM configuration

Execution

Triggers heap buffer overflow

Impact

Executes arbitrary code with Hyper-V privileges

Access

Attacker with local account logs in

Delivery

Opens Hyper-V management interface

Exploit

Sends crafted input to VM configuration

Execution

Triggers heap buffer overflow

Impact

Executes arbitrary code with Hyper-V privileges

Vulnerability AssessmentAI

Exploitation	Requires local system access with standard user privileges (PR:L). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 7.3 (HIGH). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker could exploit this vulnerability to compromise the affected system.
Remediation	Monitor vendor advisories for a patch. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all Windows Hyper-V deployments and identify systems with untrusted user access; disable guest VM access for non-essential accounts. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More from same product – last 7 days

CVE-2026-12440 CRITICAL Act Now

9.6 Jun 17

Use after free in DigitalCredentials in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to po

CVE-2026-12437 HIGH This Week

8.3 Jun 17

Use after free in WebShare in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker who had comprom

CVE-2026-12449 HIGH This Week

7.8 Jun 17

Use after free in Chromoting in Google Chrome on Windows prior to 149.0.7827.155 allowed a local attacker to perform OS-

CVE-2026-12461 MEDIUM This Month

6.5 Jun 17

Out of bounds read in WebRTC in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to obtain pot

CVE-2026-12444 MEDIUM This Month

5.5 Jun 17

Out of bounds read in Chromoting in Google Chrome on Windows prior to 149.0.7827.155 allowed a local attacker to obtain

CVE-2026-21248 vulnerability details – vuln.today

Back

Windows CVE-2026-21248

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More from same product – last 7 days

Share

External POC / Exploit Code