CVE-2026-45607: Windows Hyper-V Remote Code Execution Vulnerability

Synopsis

An out-of-bounds read vulnerability in Windows Hyper-V allows a local attacker to execute arbitrary code on the host. The flaw is reachable without any authentication or user interaction, requiring only an existing process or shell on the affected system, as indicated by the CVSS local attack vector. Successful exploitation gives the attacker full control over the host, including the ability to read, modify, or destroy data and disrupt running virtual machines. Patched-image rebuilds at the applicable fix versions are available on HarborGuard for environments running affected Windows builds.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network exposure is required.

• AuthenticationNot required

  No credentials or account privileges are needed to trigger the vulnerability.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user on the system.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or special memory layout requirements needed.

Blast Radius

• Reads arbitrary memory from the Hyper-V host process, exposing secrets, keys, or data belonging to other virtual machines.
• Writes or corrupts host memory, allowing the attacker to modify hypervisor state or tamper with guest VM configurations.
• Crashes or destabilizes the Hyper-V host, taking down all virtual machines running on the affected system.
• Achieves arbitrary code execution at the privilege level of the Hyper-V process, enabling full host takeover.