CVE-2026-25170: Windows 11 23h2 Privilege Escalation Flaw

CVE-2026-25170 Overview

CVE-2026-25170 is a use-after-free vulnerability [CWE-416] in the Windows Hyper-V virtualization stack. An authorized local attacker can exploit the flaw to elevate privileges on the host system. Microsoft published the advisory on March 10, 2026, and updated it on March 13, 2026. The vulnerability affects multiple Windows 11 client builds and Windows Server 2022 and 2025 editions. Exploitation requires local access and low privileges, but the attack complexity is high because the attacker must win a race or manipulate object lifetimes inside the Hyper-V kernel components. A successful exploit compromises confidentiality, integrity, and availability of the host.

Critical Impact
A successful exploit elevates a low-privileged local user to higher privileges within the Hyper-V host, breaking the virtualization trust boundary.

Affected Products

Microsoft Windows 11 versions 23H2, 24H2, 25H2, and 26H1 (x64 and ARM64)
Microsoft Windows Server 2022 and Windows Server 2022 23H2
Microsoft Windows Server 2025 (x64)

Discovery Timeline

2026-03-10 - CVE-2026-25170 published to NVD
2026-03-13 - Last updated in NVD database

Technical Details for CVE-2026-25170

Vulnerability Analysis

The vulnerability is a use-after-free condition in Windows Hyper-V. Hyper-V provides hardware virtualization that isolates guest virtual machines from the host kernel. A use-after-free occurs when a component continues to reference a memory object after that object has been freed. An attacker who controls the timing of allocations and frees can reclaim the freed memory with attacker-influenced data. When Hyper-V later dereferences the stale pointer, it operates on the attacker-supplied structure. This primitive can be escalated into arbitrary kernel read, write, or execution. The result is local privilege escalation on the Hyper-V host.

Root Cause

The root cause is improper object lifetime management within a Hyper-V kernel component. A reference to a heap object remains in use after the object has been released back to the pool allocator. The condition is tracked under CWE-416 (Use After Free). Microsoft has not published low-level technical details. Refer to the Microsoft CVE-2026-25170 Advisory for vendor guidance.

Attack Vector

The attack vector is local. The attacker must already hold low-level privileges on the host, such as the ability to execute code or interact with Hyper-V interfaces from a guest or local session. The high attack complexity reflects the need to reliably trigger the freed-object reuse, typically through a race condition or controlled allocator state. No user interaction is required. Successful exploitation crosses a privilege boundary, granting elevated rights on the host.

No verified public proof-of-concept exploit code is available at the time of writing. The vulnerability is described in prose only. See the vendor advisory for additional context.

Detection Methods for CVE-2026-25170

Indicators of Compromise

Unexpected vmms.exe, vmwp.exe, or vmcompute.exe crashes accompanied by pool corruption bugchecks (for example, BAD_POOL_CALLER or KERNEL_MODE_HEAP_CORRUPTION).
New or unusual processes spawned in the SYSTEM context following Hyper-V worker process activity.
Hyper-V Hypervisor and Worker event log anomalies, including repeated VM partition setup or teardown failures.

Detection Strategies

Monitor the Microsoft-Windows-Hyper-V-Worker and Microsoft-Windows-Hyper-V-Hypervisor event channels for repeated errors that may indicate exploitation attempts.
Correlate kernel crash dumps with low-privileged user sessions that recently interacted with Hyper-V interfaces or VMBus channels.
Apply behavioral identification rules that flag token manipulation or privilege escalation from non-administrative accounts on Hyper-V hosts.

Monitoring Recommendations

Track Windows Update compliance on all Hyper-V hosts and ensure the March 2026 cumulative updates are installed.
Forward Windows event logs and crash telemetry to a centralized data lake for retrospective hunting against use-after-free crash signatures.
Audit local logon and code execution on Hyper-V hosts; restrict interactive access to administrators only.

How to Mitigate CVE-2026-25170

Immediate Actions Required

Apply the March 2026 Microsoft security updates referenced in the Microsoft CVE-2026-25170 Advisory to all affected Windows 11 and Windows Server systems.
Inventory all Hyper-V hosts running Windows 11 23H2/24H2/25H2/26H1, Windows Server 2022, Windows Server 2022 23H2, and Windows Server 2025.
Restrict local logon rights and Hyper-V administrative group membership on affected hosts to reduce the pool of users who meet the local privilege precondition.

Patch Information

Microsoft has released security updates addressing CVE-2026-25170. Administrators should consult the Microsoft CVE-2026-25170 Advisory for the specific KB articles, build numbers, and deployment guidance for each affected Windows version.

Workarounds

No vendor-supplied workaround replaces patching; prioritize update deployment on Hyper-V hosts.
Where patching must be delayed, limit untrusted local code execution on Hyper-V hosts and enforce least privilege for all interactive accounts.
Isolate management interfaces of Hyper-V hosts on dedicated administrative networks to reduce exposure from compromised guest workloads.

bash

# Example: verify installed update on a Hyper-V host (PowerShell)
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
Get-WindowsUpdateLog