EUVD-2026-99081
GHSA-hg8g-x2hc-5wrq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain high-privilege access in Hyper-V context
-
DeliveryInduce required user interaction
-
ExploitTrigger heap overflow in Hyper-V component
-
ExecutionWin timing/precondition to corrupt host memory
-
PersistExecute code across VM-host boundary
-
ImpactFull host compromise (scope change)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the Hyper-V role to be enabled and the attacker to already possess high privileges (PR:H) within a local Hyper-V context, plus a triggering user interaction (UI:R) and the successful satisfaction of a hard-to-meet precondition or race (AC:H) to corrupt the heap. It is not remotely reachable (AV:L - local attack vector only). These factors - pre-existing elevated access, required user action, high attack complexity, and the need for an active Hyper-V deployment - substantially limit realistic exploitation and explain CISA's Automatable=no assessment; hosts running untrusted or multi-tenant guests face the most meaningful exposure. |
| Impact | This is a genuinely high-severity flaw but a low-urgency one in practical terms, and the signals are internally consistent rather than conflicting. The CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H, base 7.2) describes a local privilege-escalation that demands the attacker already hold high privileges (PR:H), win a difficult race or precondition (AC:H), and rely on user interaction (UI:R) - a stack of prerequisites that sharply limits opportunistic abuse. The changed scope (S:C) with total C/I/A impact reflects the classic Hyper-V guest-to-host boundary crossing, which is why Microsoft rates it total technical impact. CISA's SSVC framework agrees on the low-urgency reading: Exploitation=none (no observed or public exploitation), Automatable=no (the preconditions defeat scripted mass-exploitation), even though Technical Impact=total. There is no CISA KEV listing, no EPSS score supplied, and no public POC - so no evidence of real-world weaponization exists. Net: a serious impact ceiling (full host compromise from a VM context) but a high bar to reach it, making this a patch-on-normal-cadence item rather than an emergency, especially on hosts running untrusted guest workloads. |
| Exploit ScenarioDerived | An attacker who already has elevated privileges inside a Hyper-V context triggers a heap-based buffer overflow (CWE-122) in the virtualization stack, and with the aid of a user action and a successfully-won timing/precondition, corrupts host memory to execute code across the VM-to-host boundary. Because the scope changes (S:C), a successful attack escalates from the guest/authorized context to full compromise of the host. No public exploit code identified at time of analysis, and the high attack complexity means exploitation is non-trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Local privilege escalation in Windows Hyper-V allows an authorized attacker with high privileges on a host where the Hyper-V role is enabled to trigger a heap-based buffer overflow (CWE-122) and potentially corrupt hypervisor memory, leading to elevation of privilege. The attack is local only (AV:L) and requires high privileges (PR:H), user interaction (UI:R), and a difficult-to-achieve precondition (AC:H), with scope change (S:C) indicating potential impact beyond the hypervisor's security context. CISA's SSVC assessment rates Exploitation as none and Automatable as no; no public exploit code has been identified at time of analysis, and Microsoft has released a vendor patch.
RemediationAI
Apply the vendor-released patch: Microsoft has published security updates through the MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-108399) that resolve this vulnerability; fixed builds are those at or above the upper bounds of the affected version ranges, for example Windows 11 23H2 10.0.22631.7652, Windows 10 22H2 10.0.19044.7807, and Windows Server 2025 10.0.26100.33650. Because exploitation requires high privileges on a Hyper-V host, user interaction, and a complex precondition (AC:H), and CISA's SSVC reports Exploitation as none, patching can be scheduled according to risk, though hosts running untrusted or multi-tenant guests should be prioritized. If patching is delayed, limit the number of local users with administrative or high privileges on Hyper-V hosts (trade-off: may reduce operational flexibility); disable the Hyper-V role if virtualization is not required (trade-off: eliminates virtualization capabilities); and monitor for anomalous hypervisor crashes or heap-corruption events as a detection measure, recognizing that this is not a preventive control.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 20 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Hyper-V is Microsoft's native hypervisor, responsible for creating and managing virtual machines and isolating guest operating systems from the host and from each other. This vulnerability is a heap-based buffer overflow (CWE-122) in a Hyper-V component, where improper bounds checking when writing to a heap buffer can allow memory corruption. Per the CVSS 3.1 vector (AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H), the flaw is reachable only locally by an attacker who already holds high privileges (PR:H), requires some form of user interaction (UI:R), and is difficult to exploit due to high attack complexity (AC:H). The scope change (S:C) suggests that successful exploitation could affect resources beyond the vulnerable component's security authority, such as the hypervisor or other guests. The affected products are enumerated by EUVD as specific Windows client and server builds; the root cause class is a classic memory-safety flaw in the hypervisor's heap management logic.
Know when Hyper-V gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Local-only privilege escalation needing pre-existing high privilege (PR:H), a difficult precondition (AC:H), and user interaction (UI:R); the VM-to-host boundary crossing yields scope change with total impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
Executive ViewAI
Microsoft Hyper-V, a core virtualization platform for many organizations, is affected by a high-severity privilege escalation vulnerability that could allow an authenticated attacker with existing high privileges on a host to compromise the hypervisor, potentially impacting all hosted virtual machines. While no public exploit identified at time of analysis and exploitation requires local access and specific conditions, the potential for cross-VM compromise and data breach makes this a significant risk for environments relying on Hyper-V. Leadership should prioritize patching to prevent insider threats or lateral movement from escalating to full virtualization infrastructure compromise.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Heap-based buffer overflow in Microsoft Hyper-V (CVE-2026-83716, CVSSv3.1 8.8) lets an authenticated attacker who alread
Windows Hyper-V fails to properly enforce access controls, enabling local authenticated users to circumvent security fea
Elevation of privilege in Microsoft Hyper-V lets an attacker who already holds high privileges inside a guest virtual ma
Hyper-V on affected Windows and Windows Server hosts fails to properly verify the source of a communication channel, let
Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally. [CVSS 7.3 HIGH]
Heap overflow in Windows Hyper-V enables authenticated local users to achieve arbitrary code execution with high privile
Heap overflow in Windows Hyper-V enables authenticated local users to achieve arbitrary code execution with high privile
Local privilege elevation in Windows Hyper-V allows an attacker who already holds a low-privileged account or code-execu
An out-of-bounds read in the Microsoft Hyper-V virtualization stack allows a locally positioned attacker holding low pri
Incorrect authorization in Windows Hyper-V (CWE-863) on multiple Windows 10, Windows 11, and Windows Server versions cou
Exploit-DB