EUVD-2026-35686
GHSA-9pfr-2fjj-39px
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local Hyper-V interface reachable by any authenticated low-priv user (AV:L, PR:L, AC:L), no UI, and hypervisor code execution yields full C/I/A impact on the host.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
7DescriptionNVD
Out-of-bounds read in Windows Hyper-V allows an unauthorized attacker to execute code locally.
AnalysisAI
Local code execution in Microsoft Windows Hyper-V allows an authenticated low-privilege attacker to run arbitrary code on the host via an out-of-bounds read (CWE-125) in the hypervisor. The flaw affects a broad swath of Windows 10, Windows 11, and Windows Server builds running Hyper-V, and Microsoft has released patches. No public exploit identified at time of analysis and EPSS is very low (0.06%), but SSVC technical impact is rated total.
Technical ContextAI
Hyper-V is Microsoft's Type-1 hypervisor that underpins virtualization on client Windows (Windows 10/11) and Windows Server, providing the virtualization stack used by Windows Sandbox, WSL2, virtualization-based security (VBS), and traditional guest VMs. The root cause is CWE-125 (out-of-bounds read): the hypervisor or a Hyper-V component reads memory past the bounds of an allocated buffer, which in this case is leveraged to gain code execution rather than just disclose memory - likely because the OOB read corrupts subsequent control-flow data or feeds attacker-controlled values into a code path that the attacker can pivot from. CPE data confirms the issue affects the kernel-mode OS components (cpe:2.3:o:microsoft:...) across x64 and arm64 builds of Windows 10 1607/1809/21H2/22H2 and Windows 11 23H2/24H2/25H2, indicating the vulnerable code lives in the shipped Hyper-V binaries common to those releases.
RemediationAI
Apply the vendor-released cumulative updates from Microsoft that raise affected builds to the fixed versions listed in the EUVD data (for example 10.0.19045.7417 for Windows 10 22H2, 10.0.22631.7219 for Windows 11 23H2, 10.0.26100.8655 for Windows 11 24H2 / Server 2025, and 10.0.17763.8880 for Server 2019 and Windows 10 1809); see https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45607 for the per-KB mapping. On systems that cannot be patched immediately, restrict local logon to trusted administrators and remove the 'Hyper-V Administrators' membership from non-essential accounts (trade-off: blocks legitimate VM management), and on hosts that do not need virtualization disable the Hyper-V role/feature via Server Manager or Disable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-All (trade-off: also disables VBS/HVCI, Windows Sandbox, WSL2, and Credential Guard, which materially weakens other defenses). Prioritize Hyper-V hosts running multi-tenant or untrusted guest workloads first; pure client devices without Hyper-V enabled remain exposed in code but not exploitable until the feature is turned on.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today