CVE-2026-69603 – Windows Hyper-V Remote Code Execution Vulnerability

CVE-2026-69603 is a critical heap-based buffer overflow vulnerability in Windows Hyper-V. An authorized attacker running code inside a virtualized environment can issue a specially crafted hypercall containing a maliciously large or malformed payload size. This can trigger a buffer overflow in the hypervisor during memory operations and allow local code execution. The vulnerability requires low privileges and no user interaction.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: Successful exploitation could allow an attacker with low privileges in a virtualized environment to execute code through the Hyper-V vulnerability. The CVSS assessment identifies high potential impact to confidentiality, integrity, and availability, with scope changed. Exploitation requires local access but has low attack complexity and requires no user interaction.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is classified as Unproven, and the exploitation assessment is Exploitation Unlikely. The existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code cannot be confirmed.

TECHNICAL SUMMARY: The vulnerability is caused by a heap-based buffer overflow (CWE-122) in Windows Hyper-V. An authorized attacker can run code within a virtualized environment and issue a specially crafted hypercall containing an excessively large or malformed payload size. Manipulation of this input can cause a buffer overflow in the hypervisor during memory operations, resulting in code execution. The attack has low complexity, requires low privileges, and requires no user interaction. Its CVSS scope is changed, with confidentiality, integrity, and availability impacts all rated High.

EXPLOITABILITY: Affected products include Windows 10 versions 1607, 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, and 25H2; and Windows Server 2012, 2012 R2, 2016, 2019, 2022, and 2025, including listed Server Core installations and applicable x86, x64, and ARM64 editions. Exploitation involves running code in a virtualized environment and sending a specially crafted Hyper-V hypercall. Low privileges are required, with no user interaction.

BUSINESS IMPACT: Successful exploitation could compromise the confidentiality, integrity, and availability of affected Hyper-V environments. Because the flaw reaches the hypervisor through malicious input from a virtualized environment and carries changed scope, a compromised workload could become the starting point for a more serious security incident. For organizations relying on Hyper-V for critical workloads, successful code execution at this boundary could create significant operational and security risk.

WORKAROUND: No workaround or mitigation is identified. An official fix is available, and affected systems require a restart when the applicable update is installed.

URGENCY: This vulnerability is rated Critical with a CVSS base score of 8.8 and can result in remote code execution impact through exploitation from a virtualized environment. Although exploitation is assessed as unlikely and no active exploitation is identified, the high confidentiality, integrity, and availability impacts make prompt deployment of the official fix important, particularly on systems hosting Hyper-V workloads.