CVE-2026-45641

What it actually does

This vulnerability is an out-of-bounds read memory-corruption flaw in Windows Hyper-V. A local, unauthenticated attacker with the ability to interact with the vulnerable Hyper-V component could cause the hypervisor or related virtualization process to read memory outside its intended bounds, potentially enabling arbitrary code execution in the local virtualization context. Successful exploitation can compromise confidentiality, integrity, and availability of the affected Windows host or virtualization workload, depending on where the vulnerable code path is reached.

Why it matters to the business

Organizations using Hyper-V on affected Windows client or server versions could face host compromise, unauthorized code execution, virtual machine disruption, or exposure of sensitive workload data. Because the CVSS score is high and the attack requires no privileges or user interaction, systems running Hyper-V should be prioritized for patching even though there is currently no known exploitation, no CISA KEV listing, no ransomware association, and low EPSS probability at this time.

How an attack unfolds

An attacker first gains local execution capability or access to an interface that can reach the vulnerable Hyper-V code path. They then craft input or a sequence of interactions that causes Hyper-V to perform an out-of-bounds memory read. By shaping memory layout and triggering the flaw repeatedly or in a controlled way, the attacker may obtain sensitive memory contents, bypass protections, or influence execution flow to run attacker-controlled code locally. If exploitation succeeds on a Hyper-V host, the attacker may attempt to escalate impact by tampering with virtualization services, accessing VM-related data, disabling workloads, or using the compromised host as a foothold for further lateral movement.

How to fix it

Apply the applicable Microsoft security update for the affected Windows version as soon as it is available through Windows Update, Microsoft Update Catalog, WSUS, Intune, or other enterprise patching tooling. No fixed package versions were provided in the input, so remediation should be validated against Microsoft’s official security update guidance for CVE-2026-45641 and the relevant OS build. Prioritize systems with Hyper-V enabled, virtualization hosts, developer workstations using Hyper-V, Windows Server hosts running virtualized workloads, and systems exposing virtualization management capabilities. If immediate patching is not possible, reduce risk by disabling Hyper-V where it is not required, restricting local interactive access, limiting membership in virtualization-related administrator groups, hardening endpoint controls, and monitoring Hyper-V services for crashes or suspicious child process behavior.

How to confirm the fix worked

Confirm that affected Windows builds have received the Microsoft security update that addresses this vulnerability by checking OS build numbers, installed KBs, Windows Update compliance, or enterprise patch compliance reports. Verify whether Hyper-V is enabled using Windows Features, DISM, PowerShell, or server role inventory, and prioritize validation on hosts where Hyper-V is active. After patching, reboot where required and confirm Hyper-V services start normally and virtual machines operate as expected. For exposure assessment, inventory affected products including Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2022, and Windows Server 2025, then compare each host against Microsoft’s fixed build guidance.

Typical attack path

1. Identify an affected Windows 10, Windows 11, Windows Server 2022, or Windows Server 2025 system with Hyper-V enabled or Hyper-V components present.
2. Obtain local execution capability or access to a local interface that can interact with the vulnerable Hyper-V component.
3. Deliver crafted input or operations that trigger the out-of-bounds read condition.
4. Use memory disclosure or corruption side effects to bypass exploit mitigations or reach code execution.
5. Execute attacker-controlled code in the local Hyper-V-related context.
6. Perform post-exploitation actions such as persistence, credential access, VM tampering, data access, or service disruption.

How to detect it

There are no unique public indicators of exploitation for this vulnerability based on the provided information. Security teams should perform behavior-based detection and forensic review. Collect and review Windows Security logs, System logs, Application logs, Microsoft-Windows-Hyper-V-* event channels, Microsoft-Windows-Hyper-V-Worker, Microsoft-Windows-Hyper-V-VMMS, Microsoft-Windows-Hyper-V-Compute, Sysmon or EDR telemetry, crash dumps, Windows Error Reporting artifacts, and process creation logs. Look for abnormal crashes or restarts of Hyper-V services, repeated faults in vmwp.exe, vmms.exe, vmcompute.exe, unexpected child processes spawned by Hyper-V-related processes, suspicious memory-dump creation, unsigned binaries executed shortly after Hyper-V crashes, and local privilege escalation behavior. Investigate any sequence where a Hyper-V process crashes or restarts followed by new administrative activity, credential access, service creation, scheduled task creation, or suspicious outbound connections. If threat hunting across historical data, focus on the period since publication and prioritize unpatched Hyper-V-enabled hosts.

• Faulting application name: vmwp.exe
• Faulting application name: vmms.exe
• Faulting application name: vmcompute.exe
• Microsoft-Windows-Hyper-V-Worker
• Microsoft-Windows-Hyper-V-VMMS
• Microsoft-Windows-Hyper-V-Compute
• Windows Error Reporting
• vmwp.exe
• vmms.exe
• vmcompute.exe
• C:\ProgramData\Microsoft\Windows\WER\ReportArchive
• C:\ProgramData\Microsoft\Windows\WER\ReportQueue

What your security team should do

• Prioritize patching Hyper-V hosts and Windows systems with Hyper-V enabled, especially production virtualization servers and administrator/developer workstations.
• Use enterprise patch management to identify affected Windows versions and confirm deployment of the relevant Microsoft security update.
• If patching must be delayed, disable Hyper-V on systems that do not require it and restrict local access to systems where Hyper-V remains enabled.
• Monitor Hyper-V-related services and processes for crashes, abnormal restarts, unusual child processes, or unexpected command execution.
• Review local administrator, Hyper-V administrator, and virtualization management access to reduce opportunities for local exploitation and post-exploitation activity.
• Enable or tune endpoint detection for suspicious behavior from Hyper-V processes such as vmwp.exe, vmms.exe, vmcompute.exe, and related service hosts.
• Because no public exploit maturity, KEV listing, ransomware use, or named threat actor activity is currently reported, treat this as high-priority preventive remediation rather than confirmed active exploitation.