Windows Hyper-V: Null pointer dereference enables local denial of service

Summary

A null pointer dereference in Windows Hyper-V allows an authorized local attacker to crash the affected host or its virtual machines, causing a denial of service. The attack requires high privileges and high complexity, and it has no confidentiality or integrity impact. The CVE is not internet-facing and the main risk comes from compromised or malicious administrative accounts or VMs on Hyper-V hosts.

Affected

• Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9688)
• Windows 10 Version 1809 (10.0.17763.0 before 10.0.17763.9487)
• Windows 10 Version 21H2 and 22H2 (10.0.19045.0 before 10.0.19045.7846 according to the CNA record; conflicting data, see notes)
• Windows 11 Version 23H2 (10.0.22631.0 before 10.0.22631.7711)
• Windows 11 Version 24H2 (10.0.26100.0 before 10.0.26100.9974)
• Windows 11 Version 25H2 (10.0.26200.0 before 10.0.26200.9974)
• Windows 11 Version 26H1 (10.0.28000.0 before 10.0.28000.3501)
• Windows 11 Version 26H2 (10.0.26300.0 before 10.0.26300.9974)
• Windows Server 2016, including Server Core (10.0.14393.0 before 10.0.14393.9688)
• Windows Server 2019, including Server Core (10.0.17763.0 before 10.0.17763.9487)
• Windows Server 2022 (10.0.20348.0 before 10.0.20348.5870)

Fixed in

• Fixed in the November 2026 Patch Tuesday updates (released 10 November 2026).
• Builds per the CNA record: 10.0.14393.9688, 10.0.17763.9487, 10.0.19045.7846, 10.0.22631.7711, 10.0.26100.9974, 10.0.26200.9974, 10.0.28000.3501, 10.0.26300.9974, 10.0.20348.5870.
• Windows 10 21H2: fix build 10.0.19044.7846 according to a secondary tracker and a related Microsoft CVE; not confirmed for this CVE.
• Windows Server 2025: no specific fixed build found in the sources.

Workaround

Unknown. No vendor workaround was found in the sources.

• Interim measure (not vendor-sourced): restrict local administrative access on Hyper-V hosts.

Exploitation

• Not known to be exploited in the wild.
• Not listed in the CISA KEV catalog according to a Windows update note.
• CISA SSVC: exploitation none, not automatable.
• Rapid7: exploitation less likely, not publicly disclosed.
• No public proof of concept found.

Our recommendation

• Install the November 2026 cumulative update on Hyper-V hosts in the normal monthly patch cycle, with higher priority for multi-tenant hosts or hosts reachable by less-trusted administrators.
• Verify the affected build boundaries, especially for Windows 10 21H2/22H2, on the MSRC advisory page before relying on them.
• Restrict local administrative access on Hyper-V hosts and monitor for unexpected host or VM crashes.
• Note: two databases list this CVE with a different score (6.5) and an earlier date; the Microsoft CNA score of 5.3 is used here.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-96965 msrc.microsoft.com
• CVE.org record CVE-2026-96965 www.cve.org
• Strix AI: CVE-2026-96965 www.strix.ai
• Senserva: KB5131090 (Windows Server 2022 update) senserva.com
• OffSeq Radar: CVE-2026-96965 radar.offseq.com
• Rapid7: Patch Tuesday November 2026 www.rapid7.com
• BleepingComputer: Microsoft November 2026 Patch Tuesday www.bleepingcomputer.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:17.