# CVE-2026-40402: Microsoft Windows Hyper-V use after free privilege escalation

Source: https://junglewise.ai/threats/cve-2026-40402-microsoft-windows-hyper-v-use-after-free-privilege-escalation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-12. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-40402 · Severity: critical · CVSS 9.3 · Published 2026-05-12

A critical security flaw has been identified in Microsoft Hyper-V, the software used to create and manage virtual machines on Windows systems. This vulnerability allows an attacker who already has basic access to a guest virtual machine to break out of their isolated environment and gain full control over the host server. Such an exploit could lead to a total compromise of all data and services running on that physical hardware, potentially resulting in significant data theft or operational downtime.

Technologies: [Microsoft Hyper-V](https://junglewise.ai/threats/technologies/hyper-v). Vendors: [Microsoft](https://junglewise.ai/threats/vendors/microsoft).

## Quick answers

**Is CVE-2026-40402 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40402 being exploited in the wild.

**How severe is CVE-2026-40402?** Critical severity, with a CVSS score of 9.3, published 12 May 2026.

**Which products and versions are affected?** Microsoft Hyper-V Windows Server and Windows Desktop versions supporting Hyper-V role.

**Is there a fix for CVE-2026-40402?** A patch was published on 2026-05-12: Security updates made available via Microsoft Security Update Guide. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40402 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-40402?** Check whether you run Microsoft Hyper-V at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free (UAF) vulnerability exists in the Windows Hyper-V hypervisor, tracked as CWE-416. The flaw is triggered when the system continues to use a memory pointer after it has been freed, leading to memory corruption. An attacker with local access to a guest virtual machine can exploit this condition to execute arbitrary code with elevated privileges on the host operating system. The vulnerability is particularly severe because it involves a 'Scope' change (S:C) in the CVSS metric, indicating a successful escape from the virtualized sandbox to the physical host. Microsoft has released security updates to address this issue.

## Affected products

- Microsoft Hyper-V Windows Server and Windows Desktop versions supporting Hyper-V role

## Timeline

- 2026-05-12: disclosed: Initial disclosure by Microsoft and NVD.
- 2026-05-12: patched: Security updates made available via Microsoft Security Update Guide.

## References

- [https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40402](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40402)

## Related threats

- [Windows Hyper-V use after free privilege escalation](https://junglewise.ai/threats/cve-2026-119947-use-after-free-in-windows-hyper-v-allows-an-authorized-attacker)
- [Microsoft Windows Hyper-V heap overflow privilege escalation](https://junglewise.ai/threats/cve-2026-50680-microsoft-windows-hyper-v-heap-overflow-privilege-escalation)
- [Microsoft Hyper-V buffer over-read denial of service](https://junglewise.ai/threats/cve-2026-50485-microsoft-hyper-v-buffer-over-read-denial-of-service)
- [Microsoft Hyper-V out-of-bounds read code execution](https://junglewise.ai/threats/cve-2026-47652-microsoft-hyper-v-out-of-bounds-read-code-execution)
- [Microsoft Hyper-V code execution via type confusion](https://junglewise.ai/threats/cve-2026-45641-microsoft-hyper-v-code-execution-via-type-confusion)