EUVD-2026-44096
GHSA-m5gq-92jx-fxcv
Severity by source
AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Adjacent vector and high privileges confirmed by description's 'authorized attacker over adjacent network'; availability-only impact with no scope change.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
3DescriptionNVD
Buffer over-read in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network.
AnalysisAI
Denial of service in Windows Hyper-V allows an authorized, adjacent-network attacker to crash or disrupt the hypervisor by triggering a buffer over-read (CWE-126). Affected platforms span Windows 10, Windows 11, and Windows Server 2012 through 2025, covering a broad slice of Microsoft's enterprise footprint. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but a vendor-issued patch is available via Microsoft MSRC.
Technical ContextAI
CWE-126 describes a buffer over-read - memory is read beyond the bounds of an allocated buffer, which can leak adjacent memory contents or, as in this case, cause an access violation that terminates the affected process or system. The vulnerable component is Windows Hyper-V, Microsoft's type-1 hypervisor integrated into Windows client and server SKUs. CPE data confirms affected products include Windows 10 versions 1607 through 22H2, Windows 11 versions 24H2 through 26H1, and Windows Server 2012 through 2012 R2 (with tags extending coverage to Server 2016, 2019, 2022, and 2025). Because Hyper-V operates at a privileged hypervisor level, memory-safety bugs in its network handling stack carry elevated risk even when impact is limited to availability.
RemediationAI
Apply the patch released by Microsoft and documented in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50485. The input data confirms a patch is available per vendor advisory, but no specific fixed version number was provided; consult the MSRC page directly to identify the exact cumulative update KB article for each affected Windows SKU. As a compensating control, organizations that cannot immediately patch should restrict adjacency-layer access to Hyper-V management interfaces by enforcing network segmentation - isolating Hyper-V hosts on a dedicated management VLAN accessible only from authorized administrator workstations reduces the attack surface implied by AV:A. Note that disabling Hyper-V entirely would mitigate the vulnerability but would take all hosted virtual machines offline, making it impractical in production environments.
More in Windows Server 2012
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Remote code execution in Microsoft Office 2007-2016 and Windows Vista through 10 allows attackers to execute arbitrary c
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Active Directory Domain Services Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerabilit
Same weakness CWE-126 – Buffer Over-read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today