EUVD-2026-44096
GHSA-m5gq-92jx-fxcv
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Adjacent vector and high privileges confirmed by description's 'authorized attacker over adjacent network'; availability-only impact with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Buffer over-read in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network.
AnalysisAI
Denial of service in Windows Hyper-V allows an authorized, adjacent-network attacker to crash or disrupt the hypervisor by triggering a buffer over-read (CWE-126). Affected platforms span Windows 10, Windows 11, and Windows Server 2012 through 2025, covering a broad slice of Microsoft's enterprise footprint. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but a vendor-issued patch is available via Microsoft MSRC.
Technical ContextAI
CWE-126 describes a buffer over-read - memory is read beyond the bounds of an allocated buffer, which can leak adjacent memory contents or, as in this case, cause an access violation that terminates the affected process or system. The vulnerable component is Windows Hyper-V, Microsoft's type-1 hypervisor integrated into Windows client and server SKUs. CPE data confirms affected products include Windows 10 versions 1607 through 22H2, Windows 11 versions 24H2 through 26H1, and Windows Server 2012 through 2012 R2 (with tags extending coverage to Server 2016, 2019, 2022, and 2025). Because Hyper-V operates at a privileged hypervisor level, memory-safety bugs in its network handling stack carry elevated risk even when impact is limited to availability.
RemediationAI
Apply the patch released by Microsoft and documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50485. The input data confirms a patch is available per vendor advisory, but no specific fixed version number was provided; consult the MSRC page directly to identify the exact cumulative update KB article for each affected Windows SKU. As a compensating control, organizations that cannot immediately patch should restrict adjacency-layer access to Hyper-V management interfaces by enforcing network segmentation - isolating Hyper-V hosts on a dedicated management VLAN accessible only from authorized administrator workstations reduces the attack surface implied by AV:A. Note that disabling Hyper-V entirely would mitigate the vulnerability but would take all hosted virtual machines offline, making it impractical in production environments.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today