EUVD-2026-35687
GHSA-3hgm-7fqq-m4fp
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local guest/host access (AV:L) with low privileges (PR:L); type-confusion exploitation typically requires precise timing/memory layout (AC:H); hypervisor escape changes security scope (S:C) with total host impact.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Out-of-bounds read in Windows Hyper-V allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Windows Hyper-V allows an authenticated attacker on a guest or host to escape sandbox boundaries by triggering an out-of-bounds read condition (CWE-843, type confusion) in the hypervisor. The flaw affects Windows 10 (21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1), and Windows Server 2022/2025, with a vendor-released patch available and no public exploit identified at time of analysis. EPSS scoring of 0.15% and SSVC exploitation status of 'none' suggest limited near-term exploitation likelihood despite total technical impact potential.
Technical ContextAI
Hyper-V is Microsoft's Type-1 hypervisor that powers virtualization on Windows client and server SKUs, including Windows Sandbox, WSL2, Hyper-V VMs, and Credential Guard. CWE-843 (Access of Resource Using Incompatible Type, often called type confusion) here manifests as an out-of-bounds read, indicating the hypervisor interprets a memory region under one type while the underlying data is sized or structured differently, allowing the attacker to read past intended boundaries. Because Hyper-V code runs in the root partition or hypervisor context with the highest privilege on the system, memory disclosure or corruption primitives here can be leveraged to escape guest isolation or escalate within the host. The CPE list shows the flaw spans the kernel-mode hypervisor stack on x64 builds of Windows 10, Windows 11 (including 26H1 insider builds), Windows Server 2022, and Windows Server 2025, consistent with a shared hvix64/hvax64 codebase.
RemediationAI
Vendor-released patch: install the Microsoft cumulative update that brings the affected OS to or above the fixed build for your channel (e.g., 19044.7417/19045.7417 for Windows 10, 22631.7219 for Windows 11 23H2, 26100.8655 for 24H2, 26200.8655 for 25H2, 20348.5256 for Server 2022, 26100.32995 for Server 2025) as detailed in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45641. Until patching is complete, compensating controls include disabling the Hyper-V role on hosts that do not require virtualization (this also disables Windows Sandbox, WSL2, and Credential Guard, which is a meaningful side effect), restricting which users can create or attach VMs via the Hyper-V Administrators group to trusted accounts only, and avoiding running untrusted guests on shared hosts. On multi-tenant or sandbox-execution hosts, isolate untrusted workloads onto separate, fully patched physical hardware to limit blast radius until updates are deployed.
More in Windows 10 21h2
View all<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is l
Windows MSHTML Platform Spoofing Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitab
Same technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today