Windows Hyper-V: Elevation of privilege via untrusted pointer dereference
Summary
Microsoft Windows Hyper-V contains an untrusted pointer dereference that allows a local attacker to elevate privileges. The attacker needs local access and already has high privileges, typically administrator rights. The CVSS 3.1 base score is 8.2 (High) and the vector includes a scope change, meaning the impact crosses a security boundary.
Affected
- Microsoft Windows 11 version 26H1 (x64 and ARM64)
- Affected range: 10.0.28000.0 to before 10.0.28000.3501
- Unknown: whether Windows Server, Windows 10 or other Windows 11 builds are affected; check the MSRC advisory product table.
Fixed in
- Windows 11 version 26H1: build 10.0.28000.3501 or later, included in the November 2026 Windows security update
- KB article number: Unknown.
Workaround
Unknown.
Exploitation
- No evidence of exploitation in the wild known at the time of research.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- CVSS exploit code maturity 'Unproven': Microsoft did not know of public exploit code at release.
- No public proof of concept found.
Our recommendation
- Check the MSRC advisory for the full product list and KB number, then identify affected systems.
- Install the November 2026 Windows update, prioritising Hyper-V hosts and Windows 11 26H1 clients.
- Review local administrator accounts on Hyper-V hosts, since the attack requires high privileges.
- Re-check NVD and CISA KEV for changes in exploitation status, as NVD analysis is still pending.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Critical
- Impact
- Elevation of privilege – Windows Hyper-V
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows
- Updates (KB)
- KB5132059
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-113753 www.cve.org
- Microsoft Security Update Guide msrc.microsoft.com
- Qualys Patch Tuesday review November 2026 blog.qualys.com
- Strix.ai CVE-2026-113753 www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 01:28.
Original description (NVD)
Untrusted pointer dereference in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.