CVE-2026-45641: Windows Hyper-V Remote Code Execution Vulnerability

Synopsis

An out-of-bounds read vulnerability in Windows Hyper-V allows a local attacker to execute arbitrary code on affected systems. No network access or authentication is required; an attacker with an existing foothold on the host can trigger the flaw directly. Successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected system. Patched-image rebuilds at the available fix versions are accessible on HarborGuard for environments running affected Windows builds.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network-facing exposure is necessary to trigger the vulnerability.

• AuthenticationNot required

  No account credentials or prior authentication are required to exploit this vulnerability.

• Victim interactionNot required

  Exploitation requires no action from any user or administrator on the target system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special environmental conditions, race wins, or non-standard configuration.

Blast Radius

• Reads protected memory contents from the Hyper-V process, exposing sensitive host-level data such as cryptographic keys or guest VM memory.
• Writes arbitrary data to host memory, allowing modification of kernel structures or hypervisor state.
• Crashes or destabilizes the Hyper-V host, bringing down all guest virtual machines running on that system.
• Achieves arbitrary code execution in the context of the hypervisor, effectively compromising all guest workloads co-hosted on the same machine.