CVE-2026-80083 – Windows Hyper-V Remote Code Execution Vulnerability

CVE-2026-80083 is a critical remote code execution vulnerability in Windows Hyper-V caused by an untrusted pointer dereference. An authorized attacker with low privileges could run a specially crafted application within a Hyper-V guest and cause the Hyper-V host operating system to execute arbitrary code. No user interaction is required. The vulnerability is not publicly disclosed or known to be exploited, and exploitation is assessed as unlikely.

CVSS SCORE: 8.8.

SEVERITY: Critical.

THREAT: Successful exploitation could allow an attacker operating from a Hyper-V guest to execute arbitrary code on the host operating system. The vulnerability has low attack complexity, requires low privileges, requires no user interaction, and can result in high impact to confidentiality, integrity, and availability.

EXPLOITS: The vulnerability is not publicly disclosed and is not known to be exploited. Exploit code maturity is rated Unproven, and exploitation is assessed as unlikely. The source does not confirm the existence of public exploit or proof-of-concept code.

TECHNICAL SUMMARY: The vulnerability results from an untrusted pointer dereference (CWE-822) in Windows Hyper-V. An authorized attacker can run a specially crafted application on a Hyper-V guest that causes the Hyper-V host operating system to execute arbitrary code. The attack vector is local, attack complexity is low, and low privileges are required. No user interaction is necessary, and the CVSS scope is changed, with high potential impact to confidentiality, integrity, and availability.

EXPLOITABILITY: Affected software includes Windows 11 versions 23H2, 24H2, 25H2, and 26H1 on the listed x64 and ARM64 systems, as well as Windows Server 2022 and Windows Server 2025, including Server Core installations. Exploitation requires low privileges and a specially crafted application running on a Hyper-V guest.

BUSINESS IMPACT: Successful exploitation could compromise a Hyper-V host and expose organizations to loss of confidentiality, unauthorized modification of data or systems, and disruption of availability. Because malicious activity originating in a guest can potentially result in arbitrary code execution on the host, this vulnerability can weaken an important virtualization security boundary.

WORKAROUND: No mitigations or workarounds are identified. An official fix is available, and the affected updates require a restart.

URGENCY: This vulnerability carries a Critical severity rating and a CVSS base score of 8.8. Although exploitation is currently assessed as unlikely and no active exploitation is reported, the combination of low attack complexity, low privilege requirements, no required user interaction, and potential arbitrary code execution on the Hyper-V host makes timely deployment important.