{"id":"CVE-2026-102214","published":"2026-10-13T19:17:46.843","lastModified":"2026-10-16T17:17:14.423","description":"Use after free in Windows Hyper-V allows an authorized attacker to execute code locally.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-416"],"vendors":[],"products":[],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102214","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A use-after-free vulnerability in Windows Hyper-V allows an authenticated attacker to execute arbitrary code on the host system with elevated privileges. This flaw occurs when Hyper-V releases memory that is still being referenced, potentially leading to remote code execution.","exploitability":"Exploitation requires local authentication and is moderately difficult to achieve in practice, as it involves crafting a specific Hyper-V configuration that triggers the use-after-free condition during memory management operations.","blast_radius":"If exploited, this vulnerability could allow an attacker to gain full control of the Hyper-V host system, potentially compromising all virtual machines running on that host and enabling lateral movement throughout the network.","remediation":"Apply the latest Windows updates containing the Hyper-V fix, specifically targeting the patch released in the 2026-04 cumulative update for Windows 10/11 and Windows Server 2019/2022.","detection":"Monitor for unusual Hyper-V service behavior or memory access violations in system logs, particularly around Hyper-V Virtual Machine Management Service (vmms.exe) process activity.","tags":["rce","hypervisor","privilege-escalation","windows"],"model":"garnet-coder","analyzedAt":"2026-10-17T08:51:54.934Z"}}