Critical

Use-After-Free Privilege Escalation in Windows Hyper-V

IdentifiersCVE-2026-40402CWE-416· Use After Free

CVE-2026-40402 is a use-after-free vulnerability in Windows Hyper-V, Microsoft's built-in hypervisor. The issue affects the Hyper-V guest-to-host trust boundary and allows an unauthorized attacker to elevate privileges locally. Available reporting indicates that a malicious actor operating from within a guest VM can trigger the flaw to influence host-side memory handling, including causing the host kernel to read from an attacker-chosen memory address. Under certain circumstances this can be leveraged to escape the guest and compromise the Hyper-V host environment. Microsoft and third-party reporting consistently describe the bug as a guest-to-host Hyper-V escape with local privilege escalation characteristics.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can grant SYSTEM privileges on the Hyper-V host and break isolation between a guest VM and the host environment. In multi-tenant, private cloud, VDI, lab, or other environments running untrusted workloads, this creates scope-change risk beyond the originating guest, potentially exposing the hypervisor, host resources, and other tenants. Microsoft notes that exploitation will often result in a host denial of service or bugcheck, but in favorable conditions it may enable compromise of the host environment.

Mitigation

If you can’t patch tonight, do this now.

If immediate patching is not possible, reduce exposure by limiting or suspending untrusted guest workloads on vulnerable Hyper-V hosts, especially in multi-tenant or shared environments. Segregate sensitive workloads from hosts that run less-trusted tenants, restrict administrative access to Hyper-V infrastructure, and monitor hosts for bugchecks, anomalous VM behavior, or signs of guest-to-host boundary violations. These measures only reduce risk; vendor patching is the primary mitigation.

Remediation

Patch, then assume compromise.

Apply the official Microsoft security update for CVE-2026-40402 on all affected Hyper-V hosts. Prioritize hosts that run untrusted, externally managed, or multi-tenant guest workloads, including private cloud, VDI, and lab environments. Use normal change-control practices to patch clustered or highly available virtualization infrastructure in a coordinated manner to avoid service disruption.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Microsoft CorporationHyper-Voperating_system

Microsoft CorporationWindowsoperating_system

Microsoft CorporationWindows 11 23h2operating_system

Microsoft CorporationWindows Hyper-Voperating_system

Microsoft CorporationWindows Server 2022operating_system

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

5 SOURCESView more in app

the hacker newsNews

May 13, 2026

Microsoft Patches 138 Vulnerabilities, Including DNS and Netlogon RCE Flaws

A use-after-free vulnerability in Windows Hyper-V that allows unauthorized attackers to gain SYSTEM privileges and access the Hyper-V host environment.

outpost24 blogNews

May 13, 2026

Microsoft Patch Tuesday - May 2026

A use-after-free vulnerability in Windows Hyper-V that allows guest-to-host escape, affecting the hypervisor and potentially other tenants.

cyberthroneNews

May 13, 2026

Microsoft Patch Tuesday - May 2026 - TheCyberThrone

A Windows Hyper-V privilege escalation vulnerability with particular significance in multi-tenant and private cloud environments due to potential guest-to-host escape impact.

help net securityNews

May 12, 2026

Microsoft May 2026 Patch Tuesday: Many fixes, but no zero-days - Help Net Security

An elevation of privilege vulnerability in Hyper-V that may enable guest-to-host escalation by causing the host kernel to read from an attacker-chosen memory address.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1

Community discussion across Reddit, Mastodon, and other social sources.

EXTERNAL REFERENCES

MITRE CVE

cve.org · CVE-2026-40402

NVD

nvd.nist.gov/vuln/detail/CVE-2026-40402

MITRE CWE · CWE-416

Use After Free

Vendor Advisory

msrc.microsoft.com/update-guide/vulnerability/CVE-2026-40402