What is the CVSS score of CVE-2026-47652?

CVE-2026-47652 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Windows Hyper-V are affected by CVE-2026-47652?

Microsoft Windows Hyper-V contains a local code execution vulnerability (CVE-2026-47652, CVSS 8.2) that enables privilege escalation across virtual machine isolation boundaries, posing a direct…. A patch is available.

How to fix or mitigate CVE-2026-47652?

Within 24 hours: Identify and document all Windows Hyper-V hosts and assess current administrative account usage patterns. Within 7 days: Implement privilege restrictions on guest operating systems to limit high-privilege account creation; enable comprehensive host-level audit logging focused on privilege escalation events. Within 30 days: Monitor Microsoft security advisories for CVE-2026-47652 patch availability; conduct Hyper-V isolation boundary validation testing; document all guest-to-host privilege scenarios requiring remediation.

Windows Hyper-V CVE-2026-47652

EUVD-2026-35517 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-06-09 secure@microsoft.com

GHSA-6j5p-j4fx-r97w

Buffer Overflow Heap Overflow Microsoft Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2022 Windows Server 2025

8.2

CVSS 3.1 · Vendor: microsoft

Temporal: 7.1

Severity by source

Vendor (microsoft) PRIMARY

8.2 HIGH

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CIRCL (temporal)

7.1 HIGH

cvss

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 17:52 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 8.2

DescriptionCVE.org

Out-of-bounds read in Windows Hyper-V allows an unauthorized attacker to execute code locally.

AnalysisAI

Local code execution in Microsoft Windows Hyper-V stems from an out-of-bounds read condition (CWE-122 heap-based buffer overflow) that an attacker with high privileges on a guest or host context can leverage to break confidentiality, integrity, and availability boundaries. The CVSS 8.2 score is elevated by a scope change (S:C), indicating the flaw enables crossing the hypervisor isolation boundary. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

Hyper-V is Microsoft's Type-1 hypervisor that partitions hardware into isolated virtual machines, with the host (root partition) managing guest (child) partitions through VMBus and synthetic device interfaces. The CWE-122 classification points to a heap-based buffer overflow, specifically an out-of-bounds read where the hypervisor or a VM worker process reads beyond an allocated heap buffer. Such flaws in Hyper-V commonly arise in synthetic device emulation, VMBus message parsing, or memory management code paths where guest-controlled data influences buffer offsets, which combined with the scope change (S:C) in the CVSS vector strongly suggests the bug enables guest-to-host or cross-partition impact.

RemediationAI

Patch available per vendor advisory - consult the Microsoft Security Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47652 for the exact KB articles and cumulative update versions that apply to each affected Windows and Windows Server release, then deploy via Windows Update, WSUS, or Microsoft Update Catalog as appropriate for your patching cadence. As a compensating control where patching must be delayed, restrict which principals hold administrator rights inside guest VMs and on the host (since PR:H is required), and on multi-tenant hosts consider temporarily migrating sensitive workloads onto dedicated hosts to reduce blast radius from a hypothetical guest escape - the trade-off is operational overhead and potential service disruption during live migration. Disabling Hyper-V is not a practical workaround for hosts whose primary function is virtualization.