CVE-2026-72961 in Windows
Summary
by MITRE • 09/09/2026
Out-of-bounds read in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability described involves a critical out-of-bounds read flaw within the Microsoft Windows Hyper-V component, which serves as the underlying virtualization platform for many enterprise environments and cloud infrastructure solutions. This specific type of memory corruption error occurs when the software incorrectly calculates or validates array indices, leading to access beyond the allocated buffer boundaries. In this context, an attacker who has already gained authenticated local access on a host system can exploit this flaw to read sensitive data from kernel-mode memory that is not intended for user-level processes. The presence of such a vulnerability highlights significant gaps in boundary checking mechanisms within the hypervisor's handling of virtual machine requests or internal state management operations.
From a technical perspective, out-of-bounds reads are classified under CWE-125, which denotes an incorrect read operation performed outside the bounds of a memory buffer. This flaw differs from more destructive vulnerabilities like buffer overflows because it primarily facilitates information disclosure rather than immediate code execution through stack smashing or heap corruption. However, in the context of virtualization layers, reading arbitrary kernel memory can provide attackers with critical intelligence about system state, cryptographic keys, session tokens, or other security-critical data structures. This capability effectively bypasses standard isolation boundaries that are supposed to separate guest operating systems from each other and from the host environment, thereby undermining the fundamental trust model of virtualized environments.
The operational impact of this vulnerability is severe due to its potential for local privilege escalation. Although the initial access vector requires authentication on the host machine, which might seem restrictive, it represents a significant threat in multi-tenant scenarios or when insider threats are present. An authorized attacker can leverage the out-of-bounds read to extract sensitive information that aids further exploitation steps, such as bypassing security controls like Credential Guard or extracting password hashes for offline cracking. This aligns with ATT&CK technique T1003, which covers OS credential dumping, and potentially T1528, Steal Application Access Tokens, depending on the specific data retrieved from kernel memory. The ability to escalate privileges locally means that a compromised user account can gain SYSTEM-level access, allowing full control over the host operating system and all virtual machines running upon it.
Mitigation strategies for this vulnerability primarily involve applying the latest security updates provided by Microsoft, which patch the underlying code logic responsible for the incorrect boundary checks. Administrators should ensure that Hyper-V hosts are kept up to date with cumulative patches that address memory safety issues in core components. Additionally, implementing strict access controls and least-privilege principles can reduce the attack surface by limiting who has local administrative or interactive login rights on critical virtualization hosts. Network segmentation and monitoring for anomalous behavior related to kernel-mode interactions can also help detect exploitation attempts before they result in full system compromise. Regular auditing of user permissions and enforcing multi-factor authentication where applicable further reduces the risk of unauthorized actors gaining the initial foothold required to trigger this vulnerability.