CVE-2026-45607 Overview
CVE-2026-45607 is an out-of-bounds read vulnerability in Windows Hyper-V that allows an unauthorized attacker to execute code locally. The flaw is classified under [CWE-125] Out-of-Bounds Read and affects the hypervisor component responsible for virtualization on Windows hosts. Microsoft published the advisory on June 9, 2026, addressing the issue through the Microsoft Security Update Guide.
The vulnerability requires local access but no privileges or user interaction, and it impacts confidentiality, integrity, and availability. Successful exploitation can let an attacker escape virtualization boundaries and execute attacker-controlled code on the host. The Exploit Prediction Scoring System (EPSS) places this issue at 0.06% with a 19.07 percentile as of June 11, 2026.
Critical Impact
An attacker with local access to a guest virtual machine can read out-of-bounds memory in the Hyper-V hypervisor and execute code on the host, breaking the virtualization trust boundary.
Affected Products
- Windows Hyper-V (hypervisor component)
- Windows host operating systems that ship the Hyper-V role
- Refer to the Microsoft Security Update Guide for the authoritative list of affected builds
Discovery Timeline
- 2026-06-09 - CVE-2026-45607 published to NVD
- 2026-06-09 - Last updated in NVD database (initial revision)
- 2026-06-09 - Microsoft Security Update Guide entry published
Technical Details for CVE-2026-45607
Vulnerability Analysis
The vulnerability is an out-of-bounds read in the Windows Hyper-V virtualization stack. Hyper-V mediates guest-to-host interactions through hypercalls, virtual devices, and VMBus channels. When one of these code paths processes attacker-influenced input without validating buffer boundaries, it reads memory outside an intended structure.
The read primitive can return adjacent hypervisor or kernel memory contents. Attackers chain this disclosure with additional logic in the same code path to influence control flow, ultimately reaching arbitrary code execution on the host. Microsoft categorizes the outcome as local code execution despite the attack originating from a guest, because the attacker must already hold execution rights inside a guest VM.
Root Cause
The root cause is missing or incorrect bounds checking on a data structure parsed by Hyper-V [CWE-125]. A length, offset, or index field supplied by a lower-privileged caller is trusted without validation, causing the hypervisor to read past the end of an allocated buffer. Combined with weak isolation of the surrounding object, the resulting disclosure becomes exploitable for code execution rather than only information leakage.
Attack Vector
The attack vector is local. An attacker must run code inside a Hyper-V guest virtual machine or interact with Hyper-V interfaces from the host. From the guest, the attacker issues crafted hypercalls or virtual device requests that trigger the out-of-bounds read. No authentication to the host and no user interaction are required, which makes any guest workload a potential launching point.
No public proof-of-concept exploit is referenced in the CVE record, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical specifics are limited to Microsoft's advisory. See the Microsoft Security Update Guide for vendor-supplied details.
Detection Methods for CVE-2026-45607
Indicators of Compromise
- No public indicators of compromise have been published for CVE-2026-45607 at this time.
- Unexpected crashes or bug checks in hvix64.exe, hvax64.exe, or vmcompute.exe on Hyper-V hosts warrant investigation.
- Anomalous guest-to-host hypercall patterns or repeated VMBus channel errors preceding host instability.
Detection Strategies
- Monitor Windows Event Logs under Microsoft-Windows-Hyper-V-Hypervisor and Microsoft-Windows-Hyper-V-Worker for repeated faults tied to a specific guest VM.
- Alert on guest VM processes that spawn unexpected child processes on the host or that trigger kernel exceptions in hypervisor binaries.
- Use endpoint detection telemetry to flag privilege transitions and code execution originating from vmwp.exe worker processes.
Monitoring Recommendations
- Forward Hyper-V operational and admin channel logs to a centralized SIEM for correlation across hosts.
- Baseline normal hypercall and VMBus activity per workload, then alert on deviations from that baseline.
- Track patch deployment status across all hosts running the Hyper-V role and prioritize unpatched systems for elevated monitoring.
How to Mitigate CVE-2026-45607
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide to every Hyper-V host.
- Inventory all systems running the Hyper-V role, including Windows Server and client editions, and confirm patch coverage.
- Restrict who can deploy and run guest virtual machines on production hypervisors to reduce the local attacker pool.
Patch Information
Microsoft addressed CVE-2026-45607 through the security update published on June 9, 2026. Patch metadata, affected builds, and download links are available in the Microsoft Security Update Guide. Apply the cumulative update corresponding to each affected Windows build and reboot the host to load the updated hypervisor.
Workarounds
- No vendor-supplied workaround is documented; patching is the supported remediation path.
- For hosts that cannot be patched immediately, isolate them from untrusted guest workloads and limit administrative access to the virtualization plane.
- Consider migrating sensitive workloads to already-patched hosts using live migration until all hypervisors are updated.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
