CVE-2026-72961: Windows Hyper-V Privilege Escalation

CVE-2026-72961 Overview

CVE-2026-72961 is an out-of-bounds read vulnerability in Windows Hyper-V that enables local privilege escalation. An authorized attacker with high privileges on a guest virtual machine can read memory outside the intended buffer boundaries. Successful exploitation crosses a security scope boundary, allowing the attacker to compromise the confidentiality, integrity, and availability of resources beyond the vulnerable component. The underlying weakness is a heap-based buffer issue tracked as [CWE-122]. Microsoft published the advisory through its Security Update Guide, and the vulnerability affects Windows Hyper-V virtualization components used across Windows client and server platforms.

Critical Impact
Local privilege escalation from a guest context with the ability to break out of the Hyper-V security scope and access host resources.

Affected Products

Microsoft Windows with Hyper-V role enabled
Windows Server editions supporting Hyper-V virtualization
Windows client editions with Hyper-V feature installed

Discovery Timeline

2026-09-08 - CVE-2026-72961 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-72961

Vulnerability Analysis

The vulnerability resides in the Windows Hyper-V hypervisor stack, which manages virtual machine isolation and host-guest communication. Hyper-V exposes virtualization service providers (VSPs) on the host that respond to requests from virtualization service clients (VSCs) running inside guest VMs. An out-of-bounds read occurs when Hyper-V processes attacker-influenced data without validating buffer boundaries. The flaw is classified as a heap-based buffer weakness under [CWE-122]. Exploitation requires local access and high privileges within the guest, and no user interaction is needed. The scope-changing nature of the flaw means a successful attacker can influence resources outside the guest boundary, effectively escaping the isolation that Hyper-V is designed to enforce.

Root Cause

The root cause is missing or insufficient bounds checking when Hyper-V processes structured data on the heap. When the affected component reads a buffer whose length is derived from attacker-controlled input, it reads past the allocated region. This exposes adjacent kernel or hypervisor memory, which can contain pointers, tokens, or state that support further exploitation toward privilege escalation.

Attack Vector

The attack vector is local. An attacker must already possess high privileges inside a Hyper-V guest virtual machine. From that position, the attacker issues crafted requests to a Hyper-V interface that triggers the out-of-bounds read on the host. The disclosed memory can be leveraged to defeat address randomization or to construct a follow-on primitive that elevates privileges across the guest-host boundary.

No verified public proof-of-concept code is available. See the Microsoft Security Update Guide for vendor technical details.

Detection Methods for CVE-2026-72961

Indicators of Compromise

Unexpected crashes or bug checks in vmwp.exe, vmms.exe, or Hyper-V kernel components on the host.
Guest virtual machines issuing unusually high volumes of VMBus or hypercall requests.
New or unexpected processes spawned by the Hyper-V management stack following guest activity.

Detection Strategies

Correlate Windows Event Log entries from Microsoft-Windows-Hyper-V-Worker and Microsoft-Windows-Hyper-V-Hypervisor channels for abnormal error patterns.
Baseline hypercall and VMBus traffic per guest, then alert on statistical deviations that may indicate memory probing.
Monitor host kernel telemetry for access violations originating from virtualization worker processes.

Monitoring Recommendations

Enable and forward Hyper-V operational and admin event logs to a centralized SIEM for correlation.
Track patch state across all Hyper-V hosts and flag systems missing the Microsoft security update addressing CVE-2026-72961.
Audit accounts with administrative privileges inside guest VMs, since exploitation requires high privileges in the guest.

How to Mitigate CVE-2026-72961

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all Hyper-V hosts.
Inventory every Windows host with the Hyper-V role or feature enabled and prioritize patching for multi-tenant hosts.
Restrict administrative access within guest VMs to trusted operators only, reducing the pool of accounts that can trigger the flaw.

Patch Information

Microsoft has released a security update addressing CVE-2026-72961. Refer to the Microsoft Security Update Guide for the specific KB numbers, affected build ranges, and installation guidance for each supported Windows version.

Workarounds

Where patching cannot be performed immediately, limit which tenants or users can obtain administrator privileges inside guests hosted on shared Hyper-V infrastructure.
Isolate high-value Hyper-V hosts from workloads that permit untrusted administrators until updates are deployed.
Disable the Hyper-V role on hosts where virtualization is not required, following change control procedures.

bash

# Verify Hyper-V role status and installed updates on a Windows host
Get-WindowsFeature -Name Hyper-V
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20