CVE-2026-70248
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally.
Risk Assessment
An attacker with valid credentials could crash the Hyper-V service, causing virtual machine unavailability and disruption to infrastructure operations.
Recommendation
Apply security updates for Windows Hyper-V and restrict local access to virtualization management features.
Other vulnerabilities in Windows Hyper-V
See all- CVE-2017-8714High
The Hyper-V component on Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 1607, and Windows Server 2016 has a vulnerability allowing remote code execution when it fails to properly validate input from an authenticated user on a guest operating system.
- CVE-2017-8664High
A vulnerability in Windows Hyper-V allows remote code execution when the system fails to properly validate input from a privileged user on a guest operating system.
- CVE-2017-0193High
A vulnerability in Windows Hyper-V allows an attacker to gain elevated privileges on a target guest operating system when Hyper-V instruction emulation fails to properly enforce privilege levels.
- CVE-2017-0212High
Windows Hyper-V contains a vulnerability that allows for elevation of privilege when Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 fail to properly validate vSMB packet data.
- CVE-2026-69910Critical
Stack-based buffer overflow in Windows Hyper-V allows an unauthorized attacker to execute code remotely over a network.
- CVE-2026-40402Critical
A use after free vulnerability in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally.
- CVE-2025-21335HighActively exploited
A vulnerability in Windows Hyper-V NT Kernel Integration VSP allows for elevation of privilege. Technical details are not provided in the description.
- CVE-2025-21334HighActively exploited
A vulnerability in Windows Hyper-V NT Kernel Integration VSP allows for elevation of privilege. Technical details are not provided in the description.
- CVE-2025-21333HighActively exploited
A vulnerability in Windows Hyper-V NT Kernel Integration VSP allows for elevation of privilege. Technical details are not provided in the description.
- CVE-2024-38080HighActively exploited
A vulnerability in Windows Hyper-V allows for elevation of privilege. The NVD description does not provide technical details or required user interaction.
Original NVD description (English source)
Null pointer dereference in Windows Hyper-V allows an authorized attacker to deny service locally.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS