Windows Hyper-V Remote Code Execution Vulnerability

A stack-based buffer overflow in Windows Hyper-V could allow an attacker on your network to run arbitrary code on affected servers with system-level privileges, potentially compromising all virtual machines and workloads running on those hosts.

This affects any organization running Windows Server 2016, 2019, 2022, or 2025 with Hyper-V enabled, as well as Windows 10 and Windows 11 systems that use Hyper-V for virtualization. Water utilities and municipal electric authorities using Windows Server for SCADA systems, process management databases, or virtual infrastructure should prioritize patching. This is particularly critical if these servers host virtualized PLCs, historian databases, or operator workstations.

An attacker with network access to a Windows Server running Hyper-V could send a specially crafted network request to trigger a buffer overflow in the Hyper-V network stack, leading to remote code execution. The attacker would need to reach the Hyper-V service port on the target server directly.