Microsoft Windows Hyper-V: Double free allows local privilege escalation

Summary

Windows Hyper-V, the virtualization component of Windows 11 and Windows Server, contains a double free flaw (CWE-415). An attacker with a local low-privilege account can exploit it to gain elevated privileges, which could affect the host and the virtual machines running on it. Exploitation requires local access and a valid account; the CVSS vector rates confidentiality, integrity and availability impact as high.

Affected

• Windows 11 Version 23H2: 10.0.22631.0 to < 10.0.22631.7652
• Windows 11 Version 24H2: 10.0.26100.0 to < 10.0.26100.9711
• Windows 11 Version 25H2: 10.0.26200.0 to < 10.0.26200.9711
• Windows 11 Version 26H2: 10.0.26300.0 to < 10.0.26300.9711
• Windows Server 2022: 10.0.20348.0 to < 10.0.20348.5761
• Windows Server 2025 (including Server Core): 10.0.26100.0 to < 10.0.26100.33650

Note: the CVE record's CPE lists only Windows 11 23H2; the CNA data covers the products above.

Fixed in

• Windows 11 23H2: 10.0.22631.7652
• Windows 11 24H2: 10.0.26100.9711
• Windows 11 25H2: 10.0.26200.9711
• Windows 11 26H2: 10.0.26300.9711
• Windows Server 2022: 10.0.20348.5761
• Windows Server 2025: 10.0.26100.33650

Verify these builds and the matching KB numbers on the Microsoft Security Update Guide, as the version data was taken from secondary mirrors of the CNA record.

Workaround

Unknown. No Microsoft workaround was found; installing the Windows update is the fix.

• A secondary aggregator suggests limiting local user privileges on Hyper-V hosts. This is not from Microsoft and was not verified; treat it as general hardening only.

Exploitation

• Not listed in CISA's Known Exploited Vulnerabilities catalog.
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• No public proof of concept was found; this does not prove that none exists.
• EPSS score about 0.003.

Our recommendation

• Patch Hyper-V hosts first (Windows Server 2022/2025 with the Hyper-V role), then Windows 11 clients with Hyper-V enabled.
• Verify the build numbers on the Microsoft Security Update Guide before rollout.
• Review local accounts and reduce local logons on Hyper-V hosts; watch for phishing that could yield low-privilege credentials.
• Confirm the support status of Windows 11 23H2 on Microsoft's lifecycle page; if it is no longer supported, plan an upgrade.
• Inventory all Hyper-V systems, including Server Core installations.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-88071 msrc.microsoft.com
• Vulners MSCVE entry: MS:CVE-2026-88071 vulners.com
• Vulners CIRCL entry: CIRCL:CVE-2026-88071 vulners.com
• OpenCVE: CVE-2026-88071 app.opencve.io
• OffSeq Radar: CVE-2026-88071 radar.offseq.com
• Vulners VulnCheck entry: CVE-2026-88071 vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:32.