Windows Hyper-V: Heap-based buffer overflow
Summary
A heap-based buffer overflow in Windows Hyper-V allows an authorized local attacker to execute code. The attacker needs local access with low privileges, and because the scope changes, an escape from a guest VM can affect the host. The flaw is not directly internet-facing, and no public exploit or evidence of exploitation was found.
Affected
- Windows 10 Version 1607 (10.0.14393.0 to < 10.0.14393.9612)
- Windows 10 Version 1809 (10.0.17763.0 to < 10.0.17763.9376)
- Windows 10 Version 21H2 (10.0.19044.0 to < 10.0.19044.7807)
- Windows 10 Version 22H2 (10.0.19045.0 to < 10.0.19045.7807)
- Windows 11 Version 23H2 (10.0.22631.0 to < 10.0.22631.7652)
- Windows 11 Version 24H2 (10.0.26100.0 to < 10.0.26100.9711)
- Windows 11 Version 25H2 (10.0.26200.0 to < 10.0.26200.9711)
- Windows 11 Version 26H1 (10.0.28000.0 to < 10.0.28000.3231)
- Windows 11 Version 26H2 (10.0.26300.0 to < 10.0.26300.9711)
- Windows Server 2016 (10.0.14393.0 to < 10.0.14393.9612)
- Windows Server 2019 (10.0.17763.0 to < 10.0.17763.9376)
- Windows Server 2022 (10.0.20348.0 to < 10.0.20348.5761)
Fixed in
- Install the October 2026 Microsoft security update for each affected version. The fixed build is the upper bound of the affected range.
- Windows 10 ESU devices reportedly receive the October fixes through KB5126657 (not verified against MSRC).
- Unknown: whether Windows 10 1607 hosts are still supported or patched in practice.
Workaround
Unknown. No vendor workaround was found in the sources reviewed.
Exploitation
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- Not listed in CISA KEV according to a GitHub alert issue (not verified against KEV).
- EPSS values conflict between sources (0.00361 and 0.32%); verify on FIRST.org.
- No public proof of concept found; treat as unknown rather than absent.
Our recommendation
- Check which Hyper-V hosts run affected builds and confirm the fixed builds in the MSRC table.
- Deploy the October 2026 cumulative update, Hyper-V hosts first. Priority: medium.
- Confirm whether any Windows 10 1607 hosts are still in use and supported; replace or isolate them if not.
- Limit local logon on Hyper-V hosts and do not run untrusted guest workloads on hosts that hold sensitive VMs.
- Recheck for a public proof of concept in about two weeks.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Remote code execution – Windows Hyper-V
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows, Windows ESU (Extended Security Updates)
- Updates (KB)
- KB5126651, KB5126655, KB5126657, KB5126646, KB5127648, KB5126653
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-83716 msrc.microsoft.com
- Strix: CVE-2026-83716 www.strix.ai
- Vulners: NVD CVE-2026-83716 vulners.com
- OpenCVE: CVE-2026-83716 app.opencve.io
- Zero Day Initiative: October 2026 security update review www.zerodayinitiative.com
- Qualys: October 2026 Patch Tuesday review blog.qualys.com
- Admin365: October 2026 Patch Tuesday admin365.blog
- GitHub alert issue CVE-2026-83716 (KEV status) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:36.
Original description (NVD)
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.