CVE-2026-47652: Windows Hyper-V Remote Code Execution Vulnerability

Synopsis

An out-of-bounds read vulnerability in Windows Hyper-V allows a local attacker with administrative privileges to execute arbitrary code. The exploit runs entirely on the local machine, requires no network access, and no victim interaction, but the attacker must already hold a high-privilege account. Successful exploitation crosses the Hyper-V isolation boundary (scope change) and grants full code execution with high confidentiality, integrity, and availability impact on the host or sibling guest partitions. Patched-image rebuilds at the fix versions are available on HarborGuard for environments running affected Windows versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  An admin or otherwise high-privileged account on the local system is needed to trigger the vulnerable Hyper-V code path.

• Victim interactionNot required

  The exploit executes without any action from another user or process on the system.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no race conditions, special memory layout, or other environmental setup beyond holding the necessary privileges.

Blast Radius

• Reads protected memory across the Hyper-V isolation boundary, exposing data from the hypervisor or other guest partitions.
• Writes or corrupts memory outside the intended bounds, allowing modification of hypervisor state or guest partition data.
• Can crash or destabilize the Hyper-V host process, bringing down all virtual machines running on the affected host.
• Full code execution at the hypervisor layer means a successful attacker effectively controls the host and all workloads it manages.