{"id":"CVE-2026-97002","kind":"vulnerability","aliases":["CVE-2026-97002"],"related":[],"title":"Windows VMSwitch out-of-bounds read lets an administrator-level local user escalate privileges (Hyper-V)","description":"Out-of-bounds read in Windows VMSwitch allows an authorized attacker to elevate privileges locally.","summary":"Out-of-bounds read (CWE-125) in the Windows Hyper-V virtual switch driver (VMSwitch). Microsoft's CVSS 7.5 vector is local, high complexity, high privileges required, scope changed. Not known to be exploited; no public PoC found. Microsoft's own page (MSRC) could not be fetched, so build numbers come from a secondary site mirroring the CVE record.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Windows 10 1809","fixed":["10.0.17763.9487"],"affected":">=10.0.17763.0, <10.0.17763.9487","ecosystem":"microsoft"},{"name":"Windows 10 21H2","fixed":["10.0.19044.7846"],"affected":">=10.0.19044.0, <10.0.19044.7846","ecosystem":"microsoft"},{"name":"Windows 10 22H2","fixed":["10.0.19045.7846"],"affected":">=10.0.19045.0, <10.0.19045.7846","ecosystem":"microsoft"},{"name":"Windows 11 23H2","fixed":["10.0.22631.7711"],"affected":">=10.0.22631.0, <10.0.22631.7711","ecosystem":"microsoft"},{"name":"Windows 11 24H2","fixed":["10.0.26100.9974"],"affected":">=10.0.26100.0, <10.0.26100.9974","ecosystem":"microsoft"}],"ecosystems":[],"tags":["hyper-v","infrastructure","local","privilege-escalation","windows"],"not_affected_if":["hyper-v-disabled","patched"],"how_to_check":"Run winver or [System.Environment]::OSVersion in PowerShell and compare the build with the fixed builds below; Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V shows whether Hyper-V is on. Unconfirmed against MSRC; the list of affected products seen was truncated (+7 more), so check MSRC for Server SKUs.","fix":"Install the November 2026 Microsoft cumulative update. Fixed builds per secondary source: Win10 1809 10.0.17763.9487; Win10 21H2 10.0.19044.7846; Win10 22H2 10.0.19045.7846; Win11 23H2 10.0.22631.7711; Win11 24H2 10.0.26100.9974. Not verified on MSRC.","status":"open","published_at":"2026-11-10T19:22:23+00:00","first_seen_at":"2026-11-10T19:25:34+00:00","triaged_at":"2026-11-10T19:42:47+00:00","updated_at":"2026-11-10T19:44:29+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-10T19:42:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Windows VMSwitch: out-of-bounds read lets a local user gain higher privileges","impact":"high","summary":"Windows Hyper-V virtual switch (VMSwitch) has an out-of-bounds read flaw. An attacker who already has a local account can elevate their privileges on the machine.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["windows","hyper-v"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"local user gains SYSTEM-level privileges on the machine","analyst_note":"Confirm affected Windows builds and the Microsoft security update that fixes CVE-2026-97002 at the NVD entry and the Microsoft Security Response Center advisory.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000633,"input_tokens":4490,"output_tokens":369,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Windows builds and the Microsoft security update that fixes CVE-2026-97002 at the NVD entry and the Microsoft Security Response Center advisory.","search":"'-125':56B '-2026':21A,24A '-97002':22A,25A '10':27A,30A,33A '11':36A,39A '1809':28A '21h2':31A '22h2':34A '23h2':37A '24h2':40A '7.5':70B 'administr':11A 'administrator-level':10A 'allow':119C 'attack':122C 'author':121C 'bound':6A,53B,114C 'build':100B 'chang':80B 'come':102B 'complex':75B 'could':95B 'cve':20A,23A,109B 'cvss':69B 'cwe':55B 'driver':65B 'elev':124C 'escal':15A,48B 'exploit':85B 'fetch':98B 'found':89B 'high':74B,76B 'hyper':18A,42B,61B 'hyper-v':17A,41B,60B 'infrastructur':44B 'known':82B 'let':8A 'level':12A 'local':13A,45B,73B,126C 'microsoft':67B,90B 'mirror':107B 'msrc':94B 'number':101B 'out-of-bound':3A,50B,111C 'page':93B 'poc':88B 'privileg':16A,47B,77B,125C 'privilege-escal':46B 'public':87B 'read':7A,54B,115C 'record':110B 'requir':78B 'scope':79B 'secondari':105B 'site':106B 'switch':64B 'user':14A 'v':19A,43B,62B 'vector':71B 'virtual':63B 'vmswitch':2A,66B,118C 'window':1A,49B,59B,117C 'windows':26A,29A,32A,35A,38A","nicknames":[],"mitigations":[],"who_affected":"Windows machines with the Hyper-V role and a virtual switch (Hyper-V hosts, and clients with Hyper-V enabled) on the Windows 10 and 11 builds listed. The attacker needs local access with high privileges, so it matters most on shared or multi-tenant Hyper-V hosts. Machines without Hyper-V, or already patched to the listed builds, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["101809","1021h2","1022h2","1123h2","1124h2","windows101809","windows1021h2","windows1022h2","windows1123h2","windows1124h2"],"ptokens":["10","11","1809","21h2","22h2","23h2","24h2","windows"],"labels":["high","hyperv","infrastructure","local","privilegeescalation","windows"],"campaign_type":null,"search_a":"'-2026':21A,24A '-97002':22A,25A '10':27A,30A,33A '11':36A,39A '1809':28A '21h2':31A '22h2':34A '23h2':37A '24h2':40A 'administr':11A 'administrator-level':10A 'bound':6A 'cve':20A,23A 'escal':15A 'hyper':18A 'hyper-v':17A 'let':8A 'level':12A 'local':13A 'out-of-bound':3A 'privileg':16A 'read':7A 'user':14A 'v':19A 'vmswitch':2A 'window':1A 'windows':26A,29A,32A,35A,38A","search_b":"'-125':56B '7.5':70B 'bound':53B 'build':100B 'chang':80B 'come':102B 'complex':75B 'could':95B 'cve':109B 'cvss':69B 'cwe':55B 'driver':65B 'escal':48B 'exploit':85B 'fetch':98B 'found':89B 'high':74B,76B 'hyper':42B,61B 'hyper-v':41B,60B 'infrastructur':44B 'known':82B 'local':45B,73B 'microsoft':67B,90B 'mirror':107B 'msrc':94B 'number':101B 'out-of-bound':50B 'page':93B 'poc':88B 'privileg':47B,77B 'privilege-escal':46B 'public':87B 'read':54B 'record':110B 'requir':78B 'scope':79B 'secondari':105B 'site':106B 'switch':64B 'v':43B,62B 'vector':71B 'virtual':63B 'vmswitch':66B 'window':49B,59B","search_c":"'allow':119C 'attack':122C 'author':121C 'bound':114C 'elev':124C 'local':126C 'out-of-bound':111C 'privileg':125C 'read':115C 'vmswitch':118C 'window':117C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97002","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97002","severity":null,"published_at":"2026-11-10T19:22:23+00:00","modified_at":"2026-11-10T19:22:23+00:00","first_seen_at":"2026-11-10T19:25:34+00:00","fetched_at":"2026-11-10T19:25:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-97002:2541","url":"https://radar.offseq.com/threat/cve-2026-97002-cwe-125-out-of-bounds-read-in-microsoft-windows-10-version-1809-4acd547359cd4a63","severity":null,"published_at":"2026-11-10T19:44:29+00:00","modified_at":"2026-11-10T19:44:29+00:00","first_seen_at":"2026-11-10T19:44:29+00:00","fetched_at":"2026-11-10T19:44:29+00:00","note":"NVD/MSRC pages returned nothing via web-cli; used OffSeq mirror of the CVE record (secondary). Nothing marked verified. Revisit when MSRC page is readable to confirm full product list (7 more not seen) and fixed builds.","cites":["https://radar.offseq.com/threat/cve-2026-97002-cwe-125-out-of-bounds-read-in-microsoft-windows-10-version-1809-4acd547359cd4a63"]}],"documents":[{"id":117661,"url":"https://radar.offseq.com/threat/cve-2026-97002-cwe-125-out-of-bounds-read-in-microsoft-windows-10-version-1809-4acd547359cd4a63","title":"OffSeq Threat Radar: CVE-2026-97002 (secondary, mirrors CVE record)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}