CVE-2026-21248
Published: 10 February 2026
Summary
CVE-2026-21248 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Microsoft Windows 11 23H2. Its CVSS base score is 7.3 (High).
Operationally, ranked in the top 38.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2026-21248 is a heap-based buffer overflow vulnerability affecting Windows Hyper-V. Published on 2026-02-10T18:16:26.340, it is linked to CWEs 122 and 787, with a CVSS v3.1 base score of 7.3 (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
The vulnerability allows an authorized local attacker to execute arbitrary code. Exploitation requires local access to the system, low attack complexity, low privileges (such as a standard user account), and user interaction, without resulting in a privilege escalation. Successful exploitation can lead to high impacts on confidentiality, integrity, and availability.
Microsoft's update guide provides details on mitigation and patches for this vulnerability at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-21248.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-7357
Vulnerability details
Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Insufficient information to map techniques.CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly implements memory protections (e.g., ASLR, DEP, guard pages) that block heap-based buffer overflows from achieving arbitrary code execution in Hyper-V.
Enforces separate execution domains for Hyper-V processes and VMs, limiting the ability of a local buffer overflow to affect the hypervisor or other guests.
Requires validation of all input to Hyper-V components, which can prevent the malformed data that triggers the heap overflow.