EUVD-2026-99378
GHSA-72mw-639j-fvxf
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local access on Hyper-V host
-
DeliveryRepeatedly invoke vulnerable Hyper-V operation
-
ExploitWin TOCTOU race between check and use
-
ExecutionExecute code with SYSTEM privileges
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture TOCTOU prevention
|
| Exploitation Conditions | Requires the Windows Hyper-V role to be installed/enabled on the host and an attacker with an existing low-privileged authenticated local account or local code-execution foothold (PR:L, AV:L). Exploitation hinges on winning a time-of-check-to-time-of-use race condition (CWE-367), reflected in AC:H, meaning success is probabilistic and may require many attempts and precise timing; no user interaction is needed (UI:N). Limiting factors: no network vector (local only), high attack complexity from the race window, prerequisite valid local privileges, and applicability only to the listed unpatched Windows 10/11 and Windows Server 2019-2025 builds with Hyper-V present. |
| Impact | This is a legitimate but not top-tier priority. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) describes a local elevation-of-privilege flaw requiring existing low-privileged access and a high-complexity race window, yielding full confidentiality, integrity, and availability impact on the host. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent exploitation; the attack vector is local and AC:H (winning a TOCTOU timing race) materially raises the bar for reliable exploitation. A SSVC-style read: exploitation status appears 'none' (no KEV/POC signal), automatable is 'no' (local, race-dependent, not internet-reachable at scale), and technical impact is 'total' (C/I/A all High). Note a metadata conflict to verify: the input Tags include 'Information Disclosure', but the description and CWE-367 (TOCTOU) describe privilege escalation with full C/I/A impact, not a disclosure-only issue - treat the 'Information Disclosure' label as suspect. Overall this is a patch-in-normal-cycle EoP on Hyper-V hosts, elevated in importance only where multi-tenant virtualization or strict host isolation is a security boundary. |
| Exploit ScenarioDerived | A low-privileged user or a compromised guest-adjacent process already present on a Windows host running the Hyper-V role repeatedly triggers a Hyper-V operation while manipulating the underlying resource between the check and the use, winning the TOCTOU race to gain SYSTEM-level privileges on the host. Because the attack is local (AV:L) and high-complexity (AC:H), it requires an existing foothold and many race attempts rather than remote delivery. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Local privilege elevation in Windows Hyper-V allows an attacker who already holds a low-privileged account or code-execution foothold on the host to win a time-of-check-to-time-of-use race condition and obtain high-integrity code execution. The issue affects unpatched Windows 10 21H2/22H2, Windows 11 23H2 through 26H1, and Windows Server 2019, 2022, and 2025 builds wherever the Hyper-V role is installed, and is scored CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) - local-only access, existing privileges required, and a narrow race window that makes success probabilistic and likely to need many attempts. No public exploit has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), but a vendor patch is available and should be applied as routine maintenance.
RemediationAI
Apply the vendor-released fixes listed in the Microsoft MSRC update guide (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-83839): Windows 10 1809 and Windows Server 2019 to build 10.0.17763.9376, Windows 10 21H2/22H2 to 10.0.19044.7807, Windows 11 23H2 to 10.0.22631.7652, Windows 11 24H2 to 10.0.26100.9711, Windows 11 25H2 to 10.0.26200.9711, Windows 11 26H2 to 10.0.26300.9711, Windows 11 26H1 to 10.0.28000.3231, Windows Server 2022 to 10.0.20348.5761, and Windows Server 2025 to 10.0.26100.33650; patch status is confirmed as available from the vendor, so prioritise hosts that both run Hyper-V and permit non-administrative local logon. Until patching completes, the most effective compensating control is to remove unnecessary accounts from the Hyper-V Administrators group and to restrict interactive local logon and low-privileged code execution on Hyper-V hosts, with the trade-off that affected users lose the ability to manage virtual machines and virtual switches. On hosts that do not genuinely require virtualization, disable the Hyper-V role and its dependent features - a trade-off that breaks VMs, Windows Sandbox, WSL2, containers, and typically virtualization-based security such as Credential Guard and HVCI, so it should only be considered where those workloads are expendable. Because exploitation depends on winning a race window (CWE-367, AC:H), rate-limiting or monitoring repeated rapid Hyper-V management API activity may raise the cost of brute-forcing the window, but no configuration change reliably closes a TOCTOU defect and this should be treated as detection rather than prevention; there is no confirmed public exploit to signature against at this time, so build detections around anomalous process integrity transitions on Hyper-V hosts instead.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 13 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Hyper-V is Microsoft's Type-1 hypervisor, whose kernel-mode components manage partitions, virtual processors, memory (GPA/SPA) mappings, VMBus channels, and emulated/synthetic devices, arbitrating between the parent (host) partition and child (guest) partitions. CVE-2026-83839 is rooted in CWE-367, Time-of-Check Time-of-Use: a security-relevant property of a resource (for example a handle, object reference, or memory descriptor) is validated at one point in the hypervisor's control path and then relied upon later, leaving a window in which a local caller can alter the underlying state so that the validated property no longer holds at the moment of use. The resulting access-control bypass lets the caller act with higher integrity than their token should permit, which is why the assessed vector shows high impact on confidentiality, integrity, and availability (C:H/I:H/A:H) with scope unchanged (S:U) - the escalation stays within the host's security boundary. Notably, this is a host-side local vector (AV:L), not a guest-to-host escape path (which would be AV:A or AV:N), so it targets an attacker operating on the Hyper-V host itself rather than from inside a virtual machine; the AC:H rating reflects the timing sensitivity inherent in exploiting a race window, and UI:N indicates no victim interaction is required. No CPE strings were supplied with the intelligence, so mapping is based on the EUVD build ranges for Windows 10, Windows 11, and Windows Server editions that ship Hyper-V.
Know when Hyper-V gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Local TOCTOU race needing an existing low-privileged foothold gives AV:L/PR:L and AC:H for the timing window; successful host privilege escalation yields full C/I/A.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Time-of-check time-of-use (toctou) race condition in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
Executive ViewAI
Microsoft Windows Hyper-V hosts are affected by a high-severity local privilege-elevation flaw that could let an attacker with an existing low-level foothold on the host gain high-integrity code execution. Organizations running affected Windows 10, Windows 11, and Windows Server builds with the Hyper-V role should treat this as a priority patching item because a compromised virtualization host can undermine workload isolation and administrative control. There is no public exploit identified at time of analysis, but the vendor patch is available and should be applied as routine maintenance.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Heap-based buffer overflow in Microsoft Hyper-V (CVE-2026-83716, CVSSv3.1 8.8) lets an authenticated attacker who alread
Windows Hyper-V fails to properly enforce access controls, enabling local authenticated users to circumvent security fea
Elevation of privilege in Microsoft Hyper-V lets an attacker who already holds high privileges inside a guest virtual ma
Hyper-V on affected Windows and Windows Server hosts fails to properly verify the source of a communication channel, let
Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally. [CVSS 7.3 HIGH]
Heap overflow in Windows Hyper-V enables authenticated local users to achieve arbitrary code execution with high privile
Heap overflow in Windows Hyper-V enables authenticated local users to achieve arbitrary code execution with high privile
Local privilege escalation in Windows Hyper-V allows an authorized attacker with high privileges on a host where the Hyp
An out-of-bounds read in the Microsoft Hyper-V virtualization stack allows a locally positioned attacker holding low pri
Incorrect authorization in Windows Hyper-V (CWE-863) on multiple Windows 10, Windows 11, and Windows Server versions cou
Exploit-DB