Microsoft Windows Hyper-V: Use-after-free privilege escalation

Summary

A use-after-free flaw in Windows Hyper-V allows a local attacker with high privileges to elevate privileges on the affected system. Microsoft rates it 6.4 (CVSS 3.1, Medium) and classifies it as CWE-416. Exploitation requires local access and an already privileged account, so the risk is mainly escalation after an admin account or host has already been compromised.

Affected

• Windows 10 Version 1607 and Windows Server 2016 (including Server Core): builds before 10.0.14393.9688
• Windows 10 Version 1809 and Windows Server 2019 (including Server Core): builds before 10.0.17763.9487
• Windows 10 Version 21H2 and 22H2: builds before 10.0.19044.7846 and 10.0.19045.7846
• Windows 11 Version 23H2: builds before 10.0.22631.7711
• Windows 11 Version 24H2 and 25H2: builds before 10.0.26100.9974 and 10.0.26200.9974
• Windows 11 Version 26H1: builds before 10.0.28000.3501
• Windows 11 Version 26H2: builds before 10.0.26300.9974
• Windows Server 2022: builds before 10.0.20348.5870
• Windows Server 2025: Unknown (not listed in the official CVE record; check the MSRC page)

Fixed in

• Security updates released on November 10, 2026 (Patch Tuesday) for the builds listed above, available through Windows Update and the usual Microsoft update channels.

Workaround

• Unknown. No vendor workaround or mitigation was found; patching is the stated remedy.

Exploitation

• CISA SSVC: Exploitation none, not automatable, total technical impact.
• Rapid7: exploitation less likely, not publicly disclosed.
• No public proof of concept or exploit code was found.

Our recommendation

• Patch all affected Windows clients and servers in the November 2026 batch, starting with hosts that run the Hyper-V role or have Hyper-V enabled.
• Patch other Hyper-V elevation-of-privilege CVEs published the same day together with this one.
• Verify installed builds against the MSRC table, especially for Windows Server 2025 and Windows 11 24H2.
• Restrict local admin rights and protect privileged accounts, since exploitation requires high privileges.
• Monitor for unusual privilege changes on virtualization hosts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-113864 msrc.microsoft.com
• CVE Record: CVE-2026-113864 www.cve.org
• Strix: CVE-2026-113864 www.strix.ai
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• Talos: Microsoft Patch Tuesday November 2026 blog.talosintelligence.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:53.