CVE-2026-45641: Windows Hyper-V RCE Vulnerability

CVE-2026-45641 Overview

CVE-2026-45641 is an out-of-bounds read vulnerability in Windows Hyper-V that allows local code execution. Microsoft assigned the issue a CVSS 3.1 base score of 8.4 and categorized it under CWE-843 (Access of Resource Using Incompatible Type / Type Confusion). An unauthenticated local attacker can leverage the flaw to read memory outside intended bounds and pivot to arbitrary code execution within the hypervisor context. The flaw affects the confidentiality, integrity, and availability of the host. Microsoft published the advisory through the Microsoft Security Response Center (MSRC).

Critical Impact
Successful exploitation results in local code execution against Windows Hyper-V with high impact across confidentiality, integrity, and availability, potentially undermining virtualization-based isolation between guest and host.

Affected Products

Windows Hyper-V (host virtualization component)
Windows operating system versions shipping the affected Hyper-V binaries — refer to the Microsoft advisory for the authoritative build list
Server SKUs running the Hyper-V role

Discovery Timeline

2026-06-09 - CVE-2026-45641 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-45641

Vulnerability Analysis

The vulnerability resides in the Windows Hyper-V hypervisor stack. According to Microsoft, an out-of-bounds read condition exists that an unauthorized attacker can trigger locally to execute code. The CWE classification of [CWE-843] indicates the underlying defect involves accessing a resource using an incompatible type, which causes the component to interpret memory through a type that exceeds the bounds of the underlying allocation. Reading past the intended structure boundary leaks adjacent memory and, in this case, also enables control over execution flow.

Because Hyper-V mediates the boundary between virtual machines and the host kernel, a flaw in its parsing or dispatch logic carries direct security consequences for virtualization isolation. The EPSS score is 0.15% (35.3 percentile), reflecting that no public exploit code has been observed at the time of publication.

Root Cause

The defect is a type confusion that manifests as an out-of-bounds read. A Hyper-V code path treats a memory region as a type larger or differently structured than what was actually allocated. When the code dereferences fields based on the incorrect type, it reads memory beyond the original object. Combined with attacker-controlled inputs, the corrupted state can be steered toward an exploitable primitive that yields code execution.

Attack Vector

The CVSS vector indicates a local attack vector with low attack complexity and no privileges or user interaction required. An attacker with local access — typically code running on the host or, depending on the exposed interface, within a guest virtual machine — submits crafted input to a Hyper-V interface to trigger the type confusion. No authenticated session is required to reach the vulnerable code path.

No public proof-of-concept code is available. See the Microsoft Vulnerability Update for CVE-2026-45641 for the authoritative technical description.

Detection Methods for CVE-2026-45641

Indicators of Compromise

Unexpected vmms.exe or vmwp.exe crashes, hangs, or restarts on Hyper-V hosts
New or unsigned kernel drivers loaded on hosts running the Hyper-V role
Hyper-V-Worker or Hyper-V-Hypervisor event log entries indicating partition faults or hypercall failures
Unexpected child processes spawned by Hyper-V service accounts

Detection Strategies

Monitor Windows Event Logs under Microsoft-Windows-Hyper-V-* channels for abnormal partition, worker, or hypercall errors
Alert on local process behavior that interacts with Hyper-V device objects such as \\.\VidSysDev outside of expected administrative tooling
Correlate guest VM crashes with host-side Hyper-V worker process anomalies to surface guest-to-host attempts

Monitoring Recommendations

Apply EDR telemetry to Hyper-V hosts to capture process creation, driver loads, and memory protection changes around vmwp.exe and vmcompute.exe
Track patch state of all hosts running the Hyper-V role and flag any host missing the Microsoft fix referenced in the MSRC advisory
Centralize host and guest logs in a SIEM and build correlation rules linking guest activity to host-side Hyper-V faults

How to Mitigate CVE-2026-45641

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-45641 to all hosts running the Hyper-V role
Inventory all systems with the Hyper-V role enabled, including client SKUs using Hyper-V for WSL2, sandbox, or virtualization-based security
Restrict local logon and code execution on Hyper-V hosts to a minimal set of administrators
Review guest VM trust boundaries and tighten which workloads are permitted on shared hosts until patching completes

Patch Information

Microsoft has issued a security update for CVE-2026-45641. The authoritative patch metadata, affected builds, and update package identifiers are published at the Microsoft Vulnerability Update for CVE-2026-45641. Administrators should deploy the corresponding cumulative update through Windows Update, WSUS, Microsoft Update Catalog, or their configured patch management platform.

Workarounds

Where the Hyper-V role is not required, disable it using Disable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-All until patches are applied
Limit local interactive and remote-interactive logon rights on Hyper-V hosts to reduce the population able to reach the local attack surface
Treat untrusted guests as hostile and avoid co-locating untrusted workloads with sensitive VMs on unpatched hosts

bash

# Verify Hyper-V role status and current patch level on a Windows host
Get-WindowsFeature -Name Hyper-V
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
# Disable Hyper-V if the role is not required (requires reboot)
Disable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V-All -NoRestart