Description
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
Published: 2026-10-13
Score: 7.8 High
EPSS: < 1% Very Low
KEV: No
Impact: Local Code Execution
Action: Patch Immediately
AI Analysis

Impact

This vulnerability is a heap-based buffer overflow in Windows Hyper‑V, allowing an authorized attacker to execute code locally. The flaw can be triggered when the hypervisor processes specially crafted memory, compromising host integrity. The weakness corresponds to CWE-122.

Affected Systems

Affected by Microsoft include Windows 11 versions 23H2, 24H2, 25H2, 26H2, the 26H1 release, along with Windows Server 2022, Windows Server 2025 and its Server Core installation. The issue also impacts ARM64‑based Windows 11 26H2. The versions are listed in the CNA data.

Risk and Exploitability

The CVSS score of 7.8 indicates moderate‑to‑high severity. With no EPSS score available this does not imply low likelihood, but the flaw requires local execution privileges, meaning only attackers with authorized access to the host can exploit it. The vulnerability is not currently catalogued in CISA KEV, but patching is strongly recommended.

Generated by OpenCVE AI on October 14, 2026 at 07:15 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Microsoft security update for Windows Hyper‑V covering CVE‑2026‑83931.
  • Restrict local privileged access to the host; ensure only necessary managed accounts can use Hyper‑V.
  • Disable Hyper‑V or isolate the host if the service is not required.

Generated by OpenCVE AI on October 14, 2026 at 07:15 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_25h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26h1:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26h2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*

Fri, 23 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Microsoft windows 11 23h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows 11 26h2
Microsoft windows Server 2025 (server Core Installation)
Vendors & Products Microsoft windows 11 23h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows 11 26h2
Microsoft windows Server 2025 (server Core Installation)

Tue, 13 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Description Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
Title Windows Hyper-V Remote Code Execution Vulnerability
First Time appeared Microsoft
Microsoft windows 11 23h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows 11 Version 26h2 For Arm64-based Systems
Microsoft windows Server 2022
Microsoft windows Server 2025
Weaknesses CWE-122
CPEs cpe:2.3:a:microsoft:windows_11_version_26h2_for_arm64-based_systems:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_23H2:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_11_24H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_25H2:*:*:*:*:*:*:arm64:*
cpe:2.3:o:microsoft:windows_11_26H1:*:*:*:*:*:*:x64:*
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:*:*
Vendors & Products Microsoft
Microsoft windows 11 23h2
Microsoft windows 11 24h2
Microsoft windows 11 25h2
Microsoft windows 11 26h1
Microsoft windows 11 Version 26h2 For Arm64-based Systems
Microsoft windows Server 2022
Microsoft windows Server 2025
References
Metrics cvssV3_1

{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C'}

Subscriptions

Microsoft Windows 11 23h2 Windows 11 23h2 Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 Windows 11 25h2 Windows 11 26h1 Windows 11 26h1 Windows 11 26h2 Windows 11 Version 26h2 For Arm64-based Systems Windows Server 2022 Windows Server 2025 Windows Server 2025 (server Core Installation)
cve-icon MITRE

Status: PUBLISHED

Assigner: microsoft

Published:

Updated: 2026-10-31T18:09:40.632Z

Reserved: 2026-08-31T23:40:59.640Z

Link: CVE-2026-83931

cve-icon Vulnrichment

Updated: 2026-10-13T20:17:07.916Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-13T19:20:49.703

Modified: 2026-10-26T13:17:30.813

Link: CVE-2026-83931

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-23T19:15:14Z

Weaknesses
  • CWE-122

    Heap-based Buffer Overflow