CVE-2026-50680: Microsoft Windows Hyper-V heap overflow privilege escalation

CVE-2026-50680 · Severity: high · CVSS 8.2 · Published 2026-07-14

A security vulnerability exists in Microsoft Hyper-V, the software used to create and manage virtual machines on Windows systems. An attacker who already has high-level administrative access to a guest virtual machine could exploit this flaw to break out of their isolated environment and gain control over the host physical server. This could lead to a total compromise of the host system, including access to data from other virtual machines running on the same hardware.

Technologies: Microsoft Hyper-V, Microsoft Windows 11, Microsoft Windows 10, Microsoft Windows Server 2019, Microsoft Windows Server 2022. Vendors: Microsoft.

Quick answers

Is CVE-2026-50680 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50680 being exploited in the wild.
How severe is CVE-2026-50680?
High severity, with a CVSS score of 8.2, published 14 July 2026.
Which products and versions are affected?
Microsoft Windows 11 Multiple versions prior to July 2026 updates; Microsoft Windows 10 Multiple versions prior to July 2026 updates; Microsoft Windows Server 2019 Multiple versions prior to July 2026 updates.
Is there a fix for CVE-2026-50680?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-50680 attacked?
It is attacked with local access, in an operating system.
Am I affected by CVE-2026-50680?
Check whether you run Microsoft Hyper-V, Microsoft Windows 11, Microsoft Windows 10 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow (CWE-122) exists in the Windows Hyper-V hypervisor. The vulnerability is triggered locally by an attacker with high privileges (PR:H) on a guest operating system. By exploiting this memory corruption issue, the attacker can achieve a virtual machine escape, leading to a scope change (S:C) where they can execute arbitrary code with the privileges of the host system. This impacts the confidentiality, integrity, and availability of the entire host environment. Microsoft has released security updates to address this issue across affected versions of Windows 10, Windows 11, and Windows Server.

Affected products

  • Microsoft Windows 10 Version 1809 / 21H2 / 22H2 Multiple versions prior to July 2026 updates
  • Microsoft Windows 11 Version 24H2 / 25H2 / 26H1 Multiple versions prior to July 2026 updates
  • Microsoft Windows Server 2019 / 2022 Multiple versions prior to July 2026 updates
  • Microsoft Windows Hyper-V

Timeline

  • 2026-07-14: disclosed
  • 2026-07-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.