Advisory · CVE-2026-102214
Use-after-free in Hyper-V can break the guest-to-host boundary
Windows Hyper-V has a use-after-free flaw an authorized local attacker can use to execute code with changed scope. Microsoft rates it CVSS 3.1 8.8.
- Vendor
- Microsoft
- Product
- Windows Hyper-V
- Identifier / CWE
- CVE-2026-102214
CWE-416 - Action timing
- Immediate
Explain it like I’m five
A guest that frees and reuses hypervisor memory is a guest reaching for the host's keys.
- 01Attacker engages the component
A remote or authorized attacker sends crafted content or requests to Windows Hyper-V.
- 02Weakness triggers
The component mishandles the input and the flaw takes effect.
- 03Impact lands
The attacker gains the execution, elevation, or access the flaw allows.
What happened
Microsoft disclosed CVE-2026-102214 in its October 2026 update guide: a use-after-free weakness (CWE-416) in Windows Hyper-V lets an authorized attacker execute code with changed scope, which is the guest-to-host direction defenders worry about.
Microsoft lists the affected releases and their patched build thresholds in its update guide. Apply the October 2026 security updates for your release rather than relying on a version guess here.
What to do
- Inventory every Windows Hyper-V deployment, including test, training, and individually managed instances.
- Apply the vendor fix or upgrade exactly as directed in the linked vendor bulletin or advisory.
- Restrict network access to Windows Hyper-V while remediation is underway, especially for internet-facing instances.
- Review application and server logs for hypervisor crashes tied to specific virtual machines and unexpected host-level processes.
- Check for accounts, content, or configuration created outside normal change processes, and rotate exposed credentials where access cannot be ruled out.
- Verify the deployed version or patch level after remediation.
Management note
Hypervisor escapes are rare and serious. Patch virtualization hosts early and review which workloads share them.