Windows Hyper-V Critical Privilege Escalation via Use-After-Free

The National Vulnerability Database (NVD) has documented CVE-2026-40402, a critical use-after-free vulnerability affecting Windows Hyper-V. This flaw, rated with a CVSSv3.1 score of 9.3, allows an unauthorized local attacker to achieve privilege escalation. The high severity indicates a significant risk, as attackers can gain elevated access without requiring any user interaction or prior privileges.

This is a classic use-after-free scenario (CWE-416), a bug class frequently abused for arbitrary code execution and privilege escalation. In Hyper-V’s context, such a vulnerability is particularly dangerous; it allows an attacker who has already breached a guest VM or has local access to a Hyper-V host to potentially escape the virtualization boundary or gain system-level control over the host operating system. The attacker’s calculus here is straightforward: establish a foothold, then leverage this flaw for full system compromise.

While specific affected products beyond “Windows Hyper-V” are not detailed by the NVD, any organization running Hyper-V should consider this a top-tier threat. Defenders need to recognize that local privilege escalation is often the second stage of a more complex attack chain. Patching, rigorous access control, and continuous monitoring for unusual activity on Hyper-V hosts are paramount. Assume an attacker will always seek to escalate privileges once they land on a system.