EUVD-2026-44271
GHSA-7gm6-68gc-836h
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Guest-to-host path is adjacent rather than truly remote (AV:A), UAF needs a memory-reuse race (AC:H), and a guest foothold is required (PR:L), with full host impact and scope change.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network.
AnalysisAI
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating from a guest partition corrupt kernel memory via a use-after-free and gain higher privileges, with a scope change (S:C) indicating a guest-to-host escape. Rated CVSS 9.9 and affecting a broad range of Windows client and server releases from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025, this issue was reported by Microsoft and has a vendor patch available. No public exploit is identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
VMSwitch is the kernel-mode virtual network switch driver (vmswitch.sys) at the heart of Hyper-V networking, brokering all virtual NIC traffic between guest VMs, the host partition, and physical adapters. The flaw is a CWE-416 use-after-free: a memory object is freed while a reference to it remains reachable, so a later access operates on freed or reallocated memory. In a kernel-mode virtualization component, controlling the contents of the reclaimed allocation can yield arbitrary kernel read/write and hijacked execution. The reported scope change reflects that code executing in the security context of a guest partition can affect the more-privileged host partition, which is the defining risk of Hyper-V virtual-switch bugs.
RemediationAI
Patch available per vendor advisory: apply the Microsoft security updates for CVE-2026-57092 to every affected client and server SKU via the MSRC update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-57092, prioritizing Hyper-V hosts and any Windows Server systems running the Hyper-V role. Because exploitation requires a guest foothold reaching VMSwitch, interim compensating controls include hardening tenant/guest isolation and restricting who can create or run untrusted VMs on shared hosts; on systems where the Hyper-V role is not needed, disabling the role removes VMSwitch entirely (trade-off: eliminates all virtualization on that host). Where VMs are required, limit guest network exposure and monitor for anomalous host-partition behavior until patching completes - note these controls reduce but do not eliminate the guest-to-host attack surface, so patching remains the only complete fix.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Remote code execution in Microsoft Windows Message Queuing (MSMQ) allows an unauthenticated attacker to run arbitrary co
Same weakness CWE-416 – Use After Free
View allSame technique Use After Free
View allShare
External POC / Exploit Code
Leaving vuln.today