Microsoft Windows up to Server 2019 Hyper-V input validation

Summaryinfo

A vulnerability was found in Microsoft Windows up to Server 2019. It has been declared as critical. This issue affects some unknown processing of the component Hyper-V. Such manipulation leads to input validation. This vulnerability is referenced as CVE-2019-0965. The attack needs to be initiated within the local network. No exploit is available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Microsoft Windows up to Server 2019 (Operating System). Affected by this issue is some unknown processing of the component Hyper-V. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker could run a specially crafted application on a guest operating system that could cause the Hyper-V host operating system to execute arbitrary code. An attacker who successfully exploited the vulnerability could execute arbitrary code on the host operating system. The security update addresses the vulnerability by correcting how Hyper-V validates guest operating system user input.

The weakness was published 08/13/2019 as confirmed security update guide (Website). The advisory is shared for download at portal.msrc.microsoft.com. The public release has been coordinated with the vendor. This vulnerability is handled as CVE-2019-0965 since 11/26/2018. The exploitation is known to be difficult. Access to the local network is required for this attack to succeed. The exploitation requires an enhanced level of successful authentication. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 02/20/2026). The advisory points out:

A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker could run a specially crafted application on a guest operating system that could cause the Hyper-V host operating system to execute arbitrary code.

Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Similar entries are available at VDB-139879, VDB-139878 and VDB-139876. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Operating System

Vendor

• Microsoft

Name

• Windows

Version

• 10 1709
• 10 1803
• 10 1809
• 10 1903
• Server 1803
• Server 1903
• Server 2019

License

• commercial

Website

• Vendor: https://www.microsoft.com/
• Product: https://www.microsoft.com/en-us/windows

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion