EUVD-2026-43755
GHSA-86jj-hqjw-mj6h
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local UAF elevation-of-privilege realistically needs a local execution foothold (PR:L, AV:L, AC:L) with total impact; Microsoft's PR:N is optimistic for an EoP flaw.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Microsoft Windows Hyper-V (Windows 11 24H2/25H2/26H1 and Windows Server 2022/2025) stems from a use-after-free memory-corruption condition that lets an attacker with a local foothold execute code at elevated, potentially SYSTEM/hypervisor-level privilege. Microsoft rates it CVSS 8.4 with total confidentiality, integrity, and availability impact, and there is no public exploit identified at time of analysis. EPSS is low (0.24%, 16th percentile) and CISA SSVC lists exploitation status as none, so this is a high-severity patch-on-cycle item rather than an actively exploited emergency.
Technical ContextAI
Hyper-V is Microsoft's Type-1 (bare-metal) hypervisor built into Windows client (Pro/Enterprise) and Windows Server, responsible for virtualizing CPU, memory, and I/O for guest VMs and for underpinning Virtualization-Based Security (VBS) and Credential Guard. The flaw is a CWE-416 use-after-free: a kernel-mode object is freed while a dangling reference to it remains reachable, and subsequent reuse of that stale pointer lets an attacker control freed-memory contents and corrupt hypervisor/kernel state. Because Hyper-V runs at the highest privilege boundary on the platform, corrupting its objects can translate into arbitrary code execution or privilege elevation. The affected CPEs - Windows 11 versions 24H2/25H2/26H1 and Windows Server 2022/2025 including Server Core - confirm the defect lives in the OS-integrated Hyper-V stack rather than a standalone product.
RemediationAI
Vendor-released patch: apply the Microsoft security updates that raise affected systems to at least Windows 11 24H2 build 10.0.26100.8875, Windows 11 26H1 build 10.0.28000.2525, Windows Server 2025 (and Server Core) build 10.0.26100.33158, and Windows Server 2022 build 10.0.20348.5386; confirm the exact 25H2 fixed build directly against MSRC given the version-string inconsistency in the EUVD data. Deploy via Windows Update / WSUS / SCCM per https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-54127 and reboot to complete the hypervisor update. Where immediate patching is not possible, reduce exposure by tightening who can run code on Hyper-V hosts: restrict interactive and remote logon on virtualization hosts to trusted administrators, and limit or remove untrusted tenants from shared Hyper-V infrastructure. On any host that does not actually need virtualization, consider disabling the Hyper-V role (trade-off: this removes all VM capability and VBS/Credential Guard protections on that host, so it is only viable where those features are unused). These are compensating controls only - because the defect is in the hypervisor itself, patching is the sole complete fix.
More in Windows Server 2022
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today