CVE-2026-40402: Microsoft Windows Hyper-V use after free privilege escalation

CVE-2026-40402 · Severity: critical · CVSS 9.3 · Published 2026-05-12

A critical security flaw has been identified in Microsoft Hyper-V, the software used to create and manage virtual machines on Windows systems. This vulnerability allows an attacker who already has basic access to a guest virtual machine to break out of their isolated environment and gain full control over the host server. Such an exploit could lead to a total compromise of all data and services running on that physical hardware, potentially resulting in significant data theft or operational downtime.

Technologies: Microsoft Hyper-V. Vendors: Microsoft.

Quick answers

Is CVE-2026-40402 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40402 being exploited in the wild.
How severe is CVE-2026-40402?
Critical severity, with a CVSS score of 9.3, published 12 May 2026.
Which products and versions are affected?
Microsoft Hyper-V Windows Server and Windows Desktop versions supporting Hyper-V role.
Is there a fix for CVE-2026-40402?
A patch was published on 2026-05-12: Security updates made available via Microsoft Security Update Guide. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40402 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-40402?
Check whether you run Microsoft Hyper-V at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A use-after-free (UAF) vulnerability exists in the Windows Hyper-V hypervisor, tracked as CWE-416. The flaw is triggered when the system continues to use a memory pointer after it has been freed, leading to memory corruption. An attacker with local access to a guest virtual machine can exploit this condition to execute arbitrary code with elevated privileges on the host operating system. The vulnerability is particularly severe because it involves a 'Scope' change (S:C) in the CVSS metric, indicating a successful escape from the virtualized sandbox to the physical host. Microsoft has released security updates to address this issue.

Affected products

  • Microsoft Hyper-V Windows Server and Windows Desktop versions supporting Hyper-V role

Timeline

  • 2026-05-12: disclosed: Initial disclosure by Microsoft and NVD.
  • 2026-05-12: patched: Security updates made available via Microsoft Security Update Guide.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.