Windows Hyper-V: Use-after-free leading to local privilege escalation

Summary

A use-after-free vulnerability in Windows Hyper-V allows an authorized local attacker to elevate privileges. Exploitation requires local access, high attack complexity and existing high privileges, and the CVSS score is 7.5 with a scope change. The flaw is not reachable from the internet by itself, but it matters on Hyper-V hosts and multi-user Windows systems, where an attacker with prior access could gain higher rights. Microsoft released fixes with the November 2026 Patch Tuesday.

Affected

• Windows 10 Version 1607, 1809, 21H2, 22H2
• Windows 11 Version 23H2, 24H2, 25H2, 26H1, 26H2
• Windows Server 2016 (including Server Core), 2019 (including Server Core), 2022
• Windows Server 2025: not listed in the CVE record; verify against the MSRC advisory

Fixed in

Fixed builds according to the CVE record:

• Windows 10 1607 / Server 2016: 10.0.14393.9688
• Windows 10 1809 / Server 2019: 10.0.17763.9487
• Windows 10 21H2 and 22H2: 10.0.19044.7846 / 10.0.19045.7846
• Windows 11 23H2: 10.0.22631.7711
• Windows 11 24H2, 25H2, 26H2: 10.0.26100.9974 / 10.0.26200.9974 / 10.0.26300.9974
• Windows 11 26H1: 10.0.28000.3501
• Windows Server 2022: 10.0.20348.5870

KB article numbers: Unknown.

Workaround

Unknown. No vendor-documented workaround was found.

• If Hyper-V is not required on a system, removing the Hyper-V role reduces exposure (general hardening recommendation, not stated by the vendor).

Exploitation

• Microsoft's Security Update Guide lists the vulnerability as not exploited.
• A Talos post on the November 2026 Patch Tuesday mentions CVE-2026-119947 in an ambiguous context; other reporting links the single in-the-wild case to a different flaw. Status unconfirmed.
• No public proof-of-concept exploit found.

Our recommendation

• Patch Hyper-V hosts and Windows systems with the Hyper-V role in the next regular update window, sooner if a host runs many VMs or has several administrator accounts.
• Check whether Hyper-V is enabled on Windows 10/11 workstations and patch them too.
• Remove the Hyper-V role where it is not needed.
• Monitor the MSRC advisory for changes to the exploitation status.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-119947 msrc.microsoft.com
• CVE Record CVE-2026-119947 www.cve.org
• Talos: Microsoft Patch Tuesday for November 2026 blog.talosintelligence.com
• Qualys: Microsoft Patch Tuesday November 2026 review blog.qualys.com
• Cybersecurity News: Microsoft November 2026 Patch Tuesday cybersecuritynews.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 05:25.