CVE-2024-49117 Overview
CVE-2024-49117 is a remote code execution vulnerability affecting Microsoft Windows Hyper-V. The flaw allows an authenticated attacker with low privileges on a guest virtual machine to execute arbitrary code on the host. Microsoft disclosed the vulnerability as part of its December 2024 security update cycle. The weakness maps to [CWE-393] (Return of Wrong Status Code), indicating that Hyper-V mishandles status results in a way that enables a guest-to-host escape. Affected platforms include Windows 11 versions 22H2, 23H2, and 24H2, plus Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025.
Critical Impact
A low-privileged user inside a Hyper-V guest VM can break out of virtualization isolation and execute code on the host with scope change, compromising confidentiality, integrity, and availability of every workload sharing that hypervisor.
Affected Products
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server 2022 and Windows Server 2022 23H2
- Microsoft Windows Server 2025
Discovery Timeline
- 2024-12-12 - CVE-2024-49117 published to NVD and addressed in Microsoft's December 2024 security update
- 2025-01-14 - Last updated in NVD database
Technical Details for CVE-2024-49117
Vulnerability Analysis
The vulnerability resides in the Windows Hyper-V virtualization stack, which mediates interactions between guest virtual machines and the host partition. An attacker authenticated to a guest VM can issue crafted requests that the hypervisor processes incorrectly, resulting in arbitrary code execution on the host. The flaw enables a virtual machine escape, which collapses the isolation boundary Hyper-V is designed to enforce. Successful exploitation grants the attacker control over the host operating system and, by extension, all co-resident guest workloads. The attack requires no user interaction and can be carried out from a local context inside the guest.
Root Cause
The weakness is classified under [CWE-393] Return of Wrong Status Code. Microsoft has not published detailed internal mechanics, but the CWE mapping indicates that a Hyper-V code path returns an incorrect status value to a caller. Downstream logic then proceeds along an unsafe execution path that should have been rejected. This mishandling enables guest-controlled input to influence host execution flow.
Attack Vector
The attack vector is local to the guest VM. The attacker must already hold low-level credentials inside a guest running on a vulnerable Hyper-V host. From that position, the attacker invokes Hyper-V interfaces — such as VMBus channels or hypercalls — that traverse the trust boundary into the root partition. Because the scope changes from guest to host, the impact extends well beyond the originating VM. No verified public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
No verified public exploit code is available for CVE-2024-49117. Refer to the Microsoft Security Update Guide for vendor-provided technical context.
Detection Methods for CVE-2024-49117
Indicators of Compromise
- Unexpected process creation in the Hyper-V root partition originating from vmwp.exe or vmcompute.exe child processes
- Crashes or unexpected restarts of the vmms (Virtual Machine Management Service) on the host
- Anomalous VMBus or hypercall traffic patterns from a guest preceding host-side process anomalies
Detection Strategies
- Correlate guest-side privileged activity with host-side process and service events to identify cross-partition behaviors
- Monitor Windows Event Log channels Microsoft-Windows-Hyper-V-Worker and Microsoft-Windows-Hyper-V-Hypervisor for abnormal error codes or worker process terminations
- Baseline normal Hyper-V worker process behavior and alert on deviations such as unexpected module loads or child processes
Monitoring Recommendations
- Track installation status of the December 2024 Windows security update across all Hyper-V hosts using configuration management telemetry
- Audit which users hold local logon rights inside guest VMs, since exploitation requires authenticated guest access
- Forward Hyper-V host event logs to a centralized analytics platform for retention and cross-host correlation
How to Mitigate CVE-2024-49117
Immediate Actions Required
- Apply the December 2024 Microsoft security update to every Hyper-V host running Windows 11 22H2/23H2/24H2 or Windows Server 2022/2022 23H2/2025
- Inventory all Hyper-V hosts and prioritize patching of systems running multi-tenant or untrusted guest workloads
- Reduce the number of accounts with interactive logon rights inside guest VMs to limit the local attacker pool
Patch Information
Microsoft released fixes for CVE-2024-49117 in the December 2024 Patch Tuesday cycle. Patch availability, build numbers, and KB articles for each affected Windows version are listed in the Microsoft Security Update Guide. Administrators should validate that the cumulative update is applied to the host partition; patching guest operating systems alone does not remediate the vulnerability.
Workarounds
- No official workaround has been published by Microsoft; patching is the only supported remediation
- For unpatched hosts, restrict guest VM access to trusted administrators only and avoid hosting untrusted tenants on shared Hyper-V infrastructure
- Where feasible, migrate sensitive guests to already-patched hosts using live migration until all hypervisors are updated
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
