CVE-2025-62567: Windows 10 1607 Hyper-V DOS Vulnerability

CVE-2025-62567 Overview

CVE-2025-62567 is an integer underflow (wrap or wraparound) vulnerability [CWE-191] in Microsoft Windows Hyper-V. An authorized attacker can trigger the flaw over a network to cause a denial-of-service condition on the host. The weakness affects multiple supported releases of Windows 10, Windows 11, and Windows Server, including Hyper-V deployments on Windows Server 2016 through Windows Server 2025.

Microsoft published the advisory on December 9, 2025. The flaw does not expose confidentiality or integrity, but successful exploitation can disrupt the availability of the Hyper-V host and the virtual machines it serves.

Critical Impact
An authenticated network attacker can exhaust or crash Hyper-V services, interrupting hosted virtual workloads across affected Windows and Windows Server versions.

Affected Products

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 23H2, 24H2, 25H2)
Microsoft Windows Server 2012 R2, 2016, 2019, 2022, 2022 23H2, and 2025

Discovery Timeline

2025-12-09 - CVE-2025-62567 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62567

Vulnerability Analysis

The vulnerability resides in the Windows Hyper-V hypervisor stack. Hyper-V processes untrusted input where an arithmetic operation subtracts a larger value from a smaller unsigned value. The result wraps around to a very large positive number, producing an undersized allocation or oversized loop bound that corrupts control flow.

The outcome is a denial of service on the Hyper-V host. Because Hyper-V underpins virtualization on affected Windows Server builds, a successful attack can disrupt every tenant VM running on that host. The attack requires network reachability to the Hyper-V attack surface and valid, low-privileged credentials.

Root Cause

The root cause is improper validation of a length or counter field before an unsigned subtraction, classified as [CWE-191]. When the subtrahend exceeds the minuend, the unsigned result wraps around. Hyper-V then uses the wrapped value as a size, offset, or loop boundary, which produces an inconsistent state and terminates the service.

Attack Vector

Exploitation requires network access to a Hyper-V interface and an authenticated session with low privileges. Attack complexity is high because the attacker must shape input precisely to trigger the underflow condition. No user interaction is required. Microsoft has not reported in-the-wild exploitation, and no public proof-of-concept is available.

No verified exploit code is available. See the Microsoft Security Update Guide for CVE-2025-62567 for authoritative technical details.

Detection Methods for CVE-2025-62567

Indicators of Compromise

Unexpected termination or restart of the vmms.exe (Hyper-V Virtual Machine Management Service) or vmcompute.exe processes on hypervisor hosts.
Hyper-V-VMMS, Hyper-V-Worker, or Hyper-V-Hypervisor event log entries recording service faults or VM state changes correlated with inbound network sessions.
Loss of connectivity to hosted virtual machines without a corresponding administrative action or scheduled maintenance window.

Detection Strategies

Monitor Windows Event Logs under Microsoft-Windows-Hyper-V-* channels for repeated service crashes or worker process failures.
Alert on authenticated network sessions to Hyper-V management endpoints that immediately precede host instability or VM availability loss.
Correlate failed VM heartbeat events with authentication logs to identify low-privileged accounts initiating anomalous Hyper-V traffic.

Monitoring Recommendations

Baseline normal Hyper-V service uptime and process restart frequency, then alert on deviations.
Forward Hyper-V operational and admin event channels to a centralized SIEM for long-term retention and correlation.
Track authentication activity for accounts with Hyper-V Administrators group membership and flag unusual source IPs.

How to Mitigate CVE-2025-62567

Immediate Actions Required

Apply the Microsoft security updates referenced in the MSRC advisory for CVE-2025-62567 to all affected Windows and Windows Server hosts.
Prioritize patching Hyper-V hosts that run multi-tenant or production workloads where availability loss has the highest business impact.
Audit membership of the Hyper-V Administrators and local administrator groups to reduce the number of accounts capable of reaching the vulnerable interface.

Patch Information

Microsoft released fixes through the Security Update Guide. Administrators should install the cumulative update that corresponds to each affected Windows build and reboot Hyper-V hosts to activate the patched hypervisor binaries. Refer to the Microsoft Security Update Guide for CVE-2025-62567 for build-specific KB identifiers.

Workarounds

Restrict network reachability to Hyper-V management interfaces using host firewall rules and network segmentation until patches are deployed.
Enforce strong authentication and remove unnecessary low-privileged accounts that can reach Hyper-V services over the network.
Monitor Hyper-V host availability closely and prepare failover procedures for critical virtual machines in case of service interruption.

bash

# Example: restrict Hyper-V management traffic to a trusted subnet
New-NetFirewallRule -DisplayName "Hyper-V Mgmt Allow Trusted" \
  -Direction Inbound \
  -Program "%SystemRoot%\System32\vmms.exe" \
  -RemoteAddress 10.10.0.0/24 \
  -Action Allow

New-NetFirewallRule -DisplayName "Hyper-V Mgmt Block Other" \
  -Direction Inbound \
  -Program "%SystemRoot%\System32\vmms.exe" \
  -Action Block