CVE-2025-54091 Overview
CVE-2025-54091 is an integer overflow vulnerability in Windows Hyper-V that enables local privilege escalation. An authenticated attacker with low privileges on a Hyper-V host or guest can trigger arithmetic wraparound to corrupt heap memory and execute code in an elevated context. The flaw is classified under [CWE-122] (Heap-based Buffer Overflow) and affects a broad range of Windows client and server releases that ship the Hyper-V role. Microsoft published the advisory in the September 2025 security update cycle.
Critical Impact
Successful exploitation grants attackers high impact against confidentiality, integrity, and availability, enabling escape from a low-privileged context to SYSTEM-level control on the affected host.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server 2012, 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-09-09 - CVE-2025-54091 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-54091
Vulnerability Analysis
The vulnerability resides in the Windows Hyper-V virtualization stack. Hyper-V processes input structures whose size or count fields participate in arithmetic used to allocate heap buffers. When an attacker supplies crafted values, the arithmetic wraps around a native integer boundary, producing an undersized allocation. Subsequent copy operations write beyond the allocated region, corrupting adjacent heap metadata and objects.
An attacker who controls the corrupted objects can steer execution into attacker-influenced code paths within a privileged process. Because Hyper-V components operate at high privilege on the host, memory corruption in these paths translates directly into privilege escalation.
Root Cause
The root cause is unchecked integer arithmetic during buffer sizing, mapped to [CWE-122]. The Hyper-V code path fails to validate that multiplication or addition of user-influenced length or count fields stays within the range of the destination integer type. The wrapped value passes size checks that would otherwise reject an oversized request, and the allocator returns a buffer smaller than the data that will be copied into it.
Attack Vector
Exploitation requires local access and low privileges on a system where the Hyper-V role or client is enabled. The attack surface includes hypercalls, VMBus channels, and virtualization service providers reachable from a guest or from a local user session on the host. No user interaction is required, and the impact is confined to the vulnerable host rather than propagating across a trust boundary.
Public proof-of-concept code is not available at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
See the Microsoft Security Update Guide for vendor technical details.
Detection Methods for CVE-2025-54091
Indicators of Compromise
- Unexpected crashes, bugchecks, or WER reports involving vmcompute.exe, vmwp.exe, vmms.exe, or the hvix64 / hvax64 hypervisor images.
- New or unexpected child processes spawned from Hyper-V worker processes, particularly executing as NT AUTHORITY\SYSTEM.
- Unusual VMBus or hypercall activity originating from low-privileged user sessions on Hyper-V hosts.
Detection Strategies
- Monitor Windows Event Log channels Microsoft-Windows-Hyper-V-Worker, Microsoft-Windows-Hyper-V-Hypervisor, and Microsoft-Windows-Hyper-V-VMMS for repeated error or crash events.
- Correlate local logon events (Event ID 4624 with logon type 2 or 10) followed by Hyper-V service faults or token elevation events (Event ID 4672).
- Alert on process creation (Event ID 4688 / Sysmon 1) where a Hyper-V service process is the parent of cmd.exe, powershell.exe, or other interactive shells.
Monitoring Recommendations
- Baseline normal Hyper-V process behavior on hosts and treat deviations, especially SYSTEM-context child processes, as high-priority alerts.
- Ingest Hyper-V operational logs into a centralized SIEM or data lake to enable cross-host correlation of exploitation attempts.
- Track patch state of the Hyper-V role across all Windows client and server assets and flag hosts that remain on pre-September 2025 builds.
How to Mitigate CVE-2025-54091
Immediate Actions Required
- Apply the September 2025 (and any subsequent) Microsoft security updates to every affected Windows client and server build listed in the advisory.
- Inventory all systems with the Hyper-V role or Hyper-V Platform feature enabled, including developer workstations running WSL2, Docker Desktop, or Windows Sandbox.
- Restrict interactive and remote logon rights on Hyper-V hosts to a minimal set of administrative accounts.
Patch Information
Microsoft has released security updates for all affected Windows versions. Refer to the Microsoft Security Update Guide for CVE-2025-54091 for the specific KB identifiers that correspond to each Windows build. Install cumulative updates through Windows Update, WSUS, or Microsoft Update Catalog and reboot to activate hypervisor changes.
Workarounds
- Where patching must be deferred, disable the Hyper-V role on systems that do not require virtualization using Disable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-All.
- Enforce least privilege by removing standard users from the local Hyper-V Administrators group and any groups granting local logon to virtualization hosts.
- Segment Hyper-V hosts on management networks and restrict which accounts can create or interact with guest VMs.
# Verify Hyper-V feature state and patch level on a Windows host
Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-All
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
