What is the CVSS score of CVE-2026-25170?

CVE-2026-25170 has a CVSS 3.1 base score of 7.0 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows 11 23h2 are affected by CVE-2026-25170?

A use-after-free vulnerability in Windows Hyper-V (CVE-2026-25170) allows authorized local users to escalate privileges to system level, potentially compromising virtualized environments and the…. A patch is available.

How to fix or mitigate CVE-2026-25170?

Within 24 hours: Inventory all systems running Windows Hyper-V and assess exposure based on role-based access controls; disable Hyper-V on non-essential systems if feasible. Within 7 days: Implement network segmentation to restrict Hyper-V host access, enforce multi-factor authentication for all authorized users, and review audit logs for suspicious Hyper-V activity. Within 30 days: Establish a formal remediation plan tied to vendor patch release; consider alternative hypervisor evaluation if Hyper-V is not mission-critical; conduct tabletop exercises for privilege escalation response scenarios.

Windows 11 23h2 CVE-2026-25170

HIGH

Use After Free (CWE-416)

2026-03-10 secure@microsoft.com

Use After Free Microsoft Denial Of Service Memory Corruption Windows 11 23h2 Windows Server 2025 Windows 11 24h2 Windows 11 26h1 Windows 11 25h2 Windows Server 2022 23h2 Windows Server 2022 Windows

7.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 10, 2026 - 18:18 nvd

HIGH 7.0

DescriptionCVE.org

Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

AnalysisAI

Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. [CVSS 7.0 HIGH]

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Authenticate to Windows system

Exploit

Access Hyper-V resource after deallocation

Execution

Trigger use-after-free memory corruption

Impact

Execute arbitrary code with elevated privileges

Access

Authenticate to Windows system

Exploit

Access Hyper-V resource after deallocation

Execution

Trigger use-after-free memory corruption

Impact

Execute arbitrary code with elevated privileges

Vulnerability AssessmentAI

Exploitation	Authenticated local user access required. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 7.0 (HIGH). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker could exploit this vulnerability to compromise the affected system.
Remediation	Monitor vendor advisories for a patch. Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all systems running Windows Hyper-V and assess exposure based on role-based access controls; disable Hyper-V on non-essential systems if feasible. …

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-25170 vulnerability details – vuln.today

Back

Windows 11 23h2 CVE-2026-25170

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Share

External POC / Exploit Code