Windows Hyper-V: Elevation of privilege via out-of-bounds read

Summary

Microsoft Windows Hyper-V contains an out-of-bounds read vulnerability (CWE-125) that allows an authorized local attacker to elevate privileges. The attacker needs an existing foothold and valid access on the affected machine, so the risk is local and not directly internet-facing. Hyper-V is only relevant on systems where the Hyper-V role or feature is enabled.

Affected

• Windows 10 Version 21H2: 10.0.19044.0 to before 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.0 to before 10.0.19045.7807
• Windows 11 Version 23H2: 10.0.22631.0 to before 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to before 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to before 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.0 to before 10.0.28000.3231
• Windows 11 Version 26H2: 10.0.26300.0 to before 10.0.26300.9711
• Windows Server 2022: 10.0.20348.0 to before 10.0.20348.5761
• Windows Server 2025 (including Server Core): 10.0.26100.0 to before 10.0.26100.33650

Fixed in

• Install the Microsoft security update of October 13, 2026 (cumulative update) or a later build.
• Minimum fixed builds: 10.0.19044.7807 (21H2), 10.0.19045.7807 (22H2), 10.0.22631.7652 (23H2), 10.0.26100.9711 (24H2), 10.0.26200.9711 (25H2), 10.0.28000.3231 (26H1), 10.0.26300.9711 (26H2), 10.0.20348.5761 (Server 2022), 10.0.26100.33650 (Server 2025).
• KB numbers: to be confirmed on the MSRC Update Guide page.

Workaround

Unknown.

• No vendor workaround has been confirmed. Disabling the Hyper-V feature on systems that do not need it reduces exposure, but this has not been verified for this CVE.

Exploitation

• CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
• Not listed in the CISA Known Exploited Vulnerabilities catalog (as of the sources checked).
• Microsoft rates exploit code maturity as Unproven.
• No evidence of in-the-wild exploitation or public proof of concept was found. This means nothing is known, not that exploitation is ruled out.

Our recommendation

• Patch Windows 10 21H2 and 22H2, Windows 11 and Windows Server systems with the October 2026 cumulative update in the normal patch cycle.
• Prioritize Hyper-V hosts and multi-user systems.
• On systems without a Hyper-V need, consider disabling the Hyper-V feature.
• Confirm the Windows 10 21H2 update path and Extended Security Updates (ESU) entitlement, since 21H2 is out of mainstream support.
• Verify the CVSS vector and score on NVD, because sources differ on the privilege requirement.
• Monitor CISA KEV and exploit sources for changes.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-85369 msrc.microsoft.com
• Vulners NVD: CVE-2026-85369 vulners.com
• Rapid7 vulnerability database: CVE-2026-85369 www.rapid7.com
• OpenCVE: CVE-2026-85369 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:21.