IT SBIT Services
Schneeberger
DEEN
CVE tracker

Microsoft Windows Hyper-V: Heap-based buffer overflow allows local code execution

CVE-2026-83931High 7.8

← All vulnerabilities

Summary

A heap-based buffer overflow in the Windows Hyper-V virtualization component affects Windows 11 and Windows Server systems. An authorized attacker with low privileges and local access, such as a foothold on a guest VM, can execute code, which may lead to a guest-to-host escape. The attack complexity is high. The official CVE record and CISA SSVC data show no known exploitation.

Affected

  • Windows 11 version 23H2: 10.0.22631.0 to below 10.0.22631.7652
  • Windows 11 version 24H2: 10.0.26100.0 to below 10.0.26100.9711
  • Windows 11 version 25H2: 10.0.26200.0 to below 10.0.26200.9711
  • Windows 11 version 26H1: 10.0.28000.0 to below 10.0.28000.3231
  • Windows 11 version 26H2: 10.0.26300.0 to below 10.0.26300.9711
  • Windows Server 2022: 10.0.20348.0 to below 10.0.20348.5761
  • Windows Server 2025 (including Server Core): 10.0.26100.0 to below 10.0.26100.33650

Fixed in

  • Fixed in the October 2026 Windows security update, per the official CVE record build numbers listed above.
  • Windows 11 23H2: 10.0.22631.7652 or later (secondary sources cite KB5126653; not yet verified against MSRC).
  • Windows Server 2025: 10.0.26100.33650 or later (secondary sources cite KB5126646; not yet verified against MSRC).

Workaround

Unknown. No vendor workaround is documented in the sources reviewed. Patching is the fix.

Exploitation

  • No evidence of exploitation in the wild.
  • CISA SSVC in the NVD record: Exploitation none, Automatable no, Technical Impact total.
  • No public proof of concept found in the sources searched.
  • A third-party market estimate for an exploit is USD 5,000 to 25,000; this is not evidence of use.

Our recommendation

  • Install the October 2026 Windows security update on affected Windows 11 and Windows Server systems, prioritising Hyper-V hosts and systems with untrusted or multi-tenant guest VMs.
  • Limit administrative and local logon rights on guest VMs and review who has access to Hyper-V hosts.
  • Check whether Hyper-V is enabled on your systems and which builds are running.
  • Windows 11 23H2 Enterprise and Education reach end of updates in November 2026 according to a third-party source; plan an upgrade rather than relying on this patch alone.
  • Verify build numbers against the MSRC advisory before rollout.

Information from Microsoft (Patch Tuesday October 2026)

Severity (Microsoft)
Important
Impact
Remote code execution – Windows Hyper-V
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Windows
Updates (KB)
KB5127648, KB5126655, KB5126646, KB5126653, KB5127646

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 02:31.

Original description (NVD)

Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed