CVE-2026-45607

What it actually does

This is a local memory-corruption vulnerability in Microsoft Windows Hyper-V involving an out-of-bounds read condition. A local, unauthenticated attacker with the ability to interact with the vulnerable Hyper-V attack surface can cause Hyper-V to read memory outside intended bounds and potentially achieve local code execution. Because Hyper-V is a privileged virtualization component, successful exploitation can affect confidentiality, integrity, and availability of the Windows host and workloads running on it.

Why it matters to the business

Organizations running affected Windows client or server versions with Hyper-V enabled could face host compromise from a local attacker or malicious workload. In practical terms, this may allow an attacker who gains local access to a system to escalate their control, tamper with virtualization infrastructure, disrupt hosted workloads, or access sensitive data handled by the Hyper-V host. The CVSS score is high, but current public exploit maturity is reported as none, EPSS is low, and it is not listed in CISA KEV, so remediation should be prioritized for Hyper-V hosts, multi-user systems, developer workstations, VDI, lab environments, and servers that run untrusted or semi-trusted virtual machines.

How an attack unfolds

An attacker first obtains local execution capability on a Windows system where Hyper-V is present and the vulnerable component is reachable. The attacker then triggers the vulnerable Hyper-V code path using crafted local interaction with the virtualization subsystem. The out-of-bounds read can expose memory contents or destabilize internal state, and in a successful exploit chain may be used to execute code locally in a more privileged Hyper-V-related context. From there, the attacker may attempt to disable security tooling, access host or guest data, move laterally, or use control of the virtualization layer to interfere with workloads. No public exploitation or mature exploit code is indicated by the supplied data, so defenders should focus on patching and hunting for anomalous Hyper-V crashes, unexpected local execution paths, and suspicious activity around Hyper-V management and worker processes.

How to fix it

Apply the Microsoft security update that addresses CVE-2026-45607 for the affected Windows release. The affected product set includes Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, and 26H1; and Windows Server 2016, 2019, 2022, and 2025. No exact fixed build or KB versions were provided in the input, so use Microsoft Update, Windows Update for Business, WSUS, Microsoft Update Catalog, or your endpoint management platform to install the latest cumulative update applicable to each operating system. Where immediate patching is not possible, reduce exposure by disabling Hyper-V on systems that do not require it, restricting local interactive access, limiting who can create or manage virtual machines, avoiding execution of untrusted VMs, and applying least privilege controls around Hyper-V administration.

How to confirm the fix worked

Confirm that each affected Windows system has installed the relevant Microsoft cumulative security update released after the vulnerability disclosure date. Validate through Windows Update compliance reporting, WSUS/SCCM/Intune patch status, or local commands such as viewing installed hotfixes and OS build information. Verify whether Hyper-V is enabled using Windows Features, PowerShell, or server role inventory, and prioritize systems where the Hyper-V role, Windows Hypervisor Platform, Virtual Machine Platform, or related virtualization components are active. After remediation, confirm that Hyper-V services and workloads function normally and review recent system stability data for Hyper-V-related crashes or Windows Error Reporting events that may indicate attempted exploitation or compatibility issues.

Typical attack path

1. Gain local execution on an affected Windows 10, Windows 11, or Windows Server system with Hyper-V installed or enabled.
2. Identify that Hyper-V components are present and reachable from the local context.
3. Trigger the vulnerable Hyper-V code path using crafted input or interaction with the virtualization subsystem.
4. Abuse the out-of-bounds read condition as part of a memory-corruption exploit to achieve local code execution.
5. Execute follow-on actions from the compromised local context, such as privilege escalation, credential access, host tampering, workload disruption, or lateral movement.

How to detect it

Look for signs that the Hyper-V virtualization stack behaved abnormally before or during suspicious local activity. Useful log sources include Windows Security logs, System logs, Application logs, Windows Error Reporting, Microsoft-Windows-Hyper-V-* operational logs, Sysmon or EDR telemetry, PowerShell logs, and endpoint process/file/network telemetry. Hunt for crashes or faulting events involving Hyper-V worker and management processes, unexpected creation or modification of virtual machines, unusual use of Hyper-V PowerShell cmdlets, new local administrator membership, suspicious child processes spawned around Hyper-V management activity, credential access after Hyper-V faults, and endpoint protection tampering. Since no public exploit pattern or network signature is provided, detections should be behavior-based rather than relying on a single definitive IOC. Pay particular attention to sequences where vmwp.exe, vmms.exe, vmcompute.exe, or related Hyper-V services crash, restart, or log errors shortly before privilege escalation, new service creation, unsigned binary execution, or unusual administrative actions.

• vmwp.exe
• vmms.exe
• vmcompute.exe
• Microsoft-Windows-Hyper-V-Worker
• Microsoft-Windows-Hyper-V-VMMS
• Microsoft-Windows-Hyper-V-Compute
• Microsoft-Windows-Hyper-V-Hypervisor
• Faulting application name: vmwp.exe
• Faulting application name: vmms.exe
• Faulting application name: vmcompute.exe
• Windows Error Reporting
• New-VM
• Set-VM
• Start-VM
• Checkpoint-VM
• Import-VM
• Enable-WindowsOptionalFeature -FeatureName Microsoft-Hyper-V
• Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V
• C:\Windows\System32\vmwp.exe
• C:\Windows\System32\vmms.exe
• C:\Windows\System32\vmcompute.exe

What your security team should do

• Prioritize patching on Windows Server hosts, Hyper-V clusters, VDI infrastructure, developer workstations using local virtualization, and any systems that run untrusted or externally supplied virtual machines.
• Inventory where Hyper-V, Windows Hypervisor Platform, Virtual Machine Platform, or related virtualization features are enabled across affected Windows versions.
• Disable Hyper-V and related virtualization features on endpoints and servers that do not require them.
• Restrict Hyper-V administration rights and local interactive access to trusted administrators only.
• Monitor for abnormal Hyper-V worker process crashes, unexpected VM lifecycle events, suspicious local process execution, and privilege escalation activity on systems where patching is delayed.
• Treat successful exploitation as a potential host compromise and investigate guest-to-host, host-to-guest, and lateral movement activity if suspicious Hyper-V behavior is observed.
• Because the issue is not currently in CISA KEV, has no reported ransomware association, and has low EPSS, use risk-based prioritization rather than emergency response unless threat intelligence changes or exploitation indicators appear.