CVE-2026-45607: Windows Hyper-V Out-of-Bounds Read Code Execution (CVSS 8.4)

Technical summary

An out-of-bounds read condition exists in the Windows Hyper-V hypervisor (CWE-125). The vulnerability allows a local, unauthenticated attacker to read memory beyond allocated buffer boundaries, which can be leveraged to extract sensitive data or craft an exploit leading to code execution with elevated privileges. The attack surface is confined to the local system; remote exploitation is not possible. The CVSS 3.1 score of 8.4 reflects high impact across confidentiality, integrity, and availability, with low attack complexity and no privileges required.

Business impact

Compromise of a Hyper-V host can cascade into broad infrastructure damage. An attacker exploiting this flaw gains local code execution, potentially allowing lateral movement within virtual machine clusters, theft of guest VM memory or credentials, denial of service to virtualized workloads, and persistence across guest boundaries. In datacenter and cloud scenarios, this represents a critical containment failure. Organizations with multi-tenant or segmented Hyper-V deployments face elevated risk of cross-tenant data leakage.

Affected systems

The vulnerability affects multiple Windows 10 and Windows 11 builds (1607, 1809, 21H2, 22H2, 23H2, 24H2, 25H2, 26H1) and Windows Server versions (2016, 2019, 2022, 2025). Any system with Hyper-V enabled is in scope. This includes virtualized enterprise servers, cloud-hosting platforms, and development labs running nested hypervisors. The affected versions span both in-support and extended-support Windows releases.

Exploitability

Exploitation requires local system access; an attacker cannot trigger this remotely over the network. However, the lack of privilege requirement or user interaction lowers the bar significantly. Any locally-authenticated user, compromised service account, or malware with filesystem access can attempt exploitation. Guest-to-host escape is a plausible attack chain if an attacker first compromises a virtual machine. The CVSS vector (AV:L/AC:L/PR:N/UI:N) indicates attack complexity is low, suggesting a reliable exploit technique may be available. The vulnerability is not yet tracked in public exploit databases, but the straightforward nature of out-of-bounds reads suggests security researchers will likely develop proof-of-concept code.

Remediation

Apply the latest cumulative update or security patch from Microsoft for your Windows version. Verify against the official Microsoft Security Update Guide (portal.msrc.microsoft.com) for the specific KB article and build numbers. Organizations should prioritize patching Hyper-V hosts in production environments, particularly those hosting untrusted or multi-tenant workloads. Interim mitigations include restricting local access to systems, disabling Hyper-V where not required, and isolating sensitive guest VMs on patched hosts.

Patch guidance

Monitor the Microsoft Security Update Guide for CVE-2026-45607 patches. Patches will be rolled into monthly cumulative updates for each supported Windows version and Server release. Test patches in a non-production Hyper-V lab first to confirm VM stability and any compatibility implications with guest operating systems. Prioritize patching in this order: (1) production Hyper-V hosts handling untrusted workloads, (2) multi-tenant or cloud-hosting environments, (3) development and lab hypervisors. Plan for system restart as part of update deployment.

Detection guidance

Monitor for suspicious local process activity on Hyper-V hosts, particularly unexpected reads of kernel memory or calls to Hyper-V-related APIs (e.g., WMI virtualization classes, Hyper-V management service). Track failed and succeeded privilege escalation attempts. Check for abnormal child process spawning or unexpected code execution originating from low-privilege accounts. Log analysis of Windows Security Event ID 4688 (process creation) may reveal attempts to access Hyper-V management tools or memory-scanning utilities. Network detection is unlikely to be productive since the vulnerability is local; focus on host-based indicators and behavioral anomalies.

Why prioritize this

This vulnerability merits immediate attention due to its high CVSS score (8.4), absence of privilege requirements, and the strategic importance of Hyper-V infrastructure in enterprise and cloud environments. The local attack surface and code execution outcome create a direct risk to virtualized assets and data. Although not yet actively exploited in the wild (not on KEV), the technical simplicity and broad affected version range suggest rapid adoption of working exploits is probable. Hyper-V hosts should be treated as critical assets in patch prioritization.

Risk score, explained

The CVSS 3.1 score of 8.4 (HIGH) is driven by complete compromise of system confidentiality, integrity, and availability (C:H, I:H, A:H), combined with low barriers to attack (AV:L, AC:L, PR:N, UI:N). The severity is tempered only by the requirement for local access. In a typical enterprise, local access is abundant through service accounts, contractors, shared systems, and compromised workstations; the 'local' requirement therefore does not substantially reduce real-world risk. The absence of scope crossing (S:U) prevents an CVSS uplift, but in practice, guest-to-host escape elevates impact.

Frequently asked questions