CVE-2024-38080: Windows Hyper-V elevation of privilege via integer overflow

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with confirmed in-the-wild exploitation and high CVSS impact, but requires local low-privileged access, which limits reach.

What it is

CVE-2024-38080 is an elevation of privilege flaw in Microsoft Windows Hyper-V, tied to an integer overflow (CWE-190) per the CWE mapping, though NVD also lists insufficient information. It matters because it is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild, and it affects current Windows 11 and Windows Server 2022 builds.

Impact

A local attacker who already has low privileges can exploit this to gain high-level confidentiality, integrity and availability impact on the host, effectively escalating to full control of the affected system.

Attack surface

The CVSS vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), so the attacker must already have code execution or an account on the target. It is not remotely reachable without prior access.

Exploitation

CISA added it to KEV on 2024-07-09 with a remediation due date of 2024-07-30, confirming known exploitation; EPSS 30-day probability is about 7.1 percent (93.9th percentile). No ransomware campaign use is recorded.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2024-38080 as the first action.
• If patching cannot be completed immediately, follow CISA's required action and vendor mitigations, or discontinue use of the affected product.
• Restrict and monitor local interactive and service account access on Hyper-V hosts to reduce the pool of low-privileged attackers who can reach the flaw.
• Review Hyper-V host and guest isolation configuration and limit who can run workloads on the hypervisor.
• Track the KEV due date of 2024-07-30 and confirm remediation across all listed Windows 11 and Windows Server 2022 builds.

Detection

• Monitor for unexpected privilege escalation or new high-integrity processes originating from low-privileged contexts on Hyper-V hosts.
• Alert on unusual Hyper-V service, vmcompute or hypervisor-related process activity and crashes that could indicate integer overflow exploitation attempts.
• Correlate local logon and process creation events on Hyper-V hosts for anomalies consistent with post-exploitation escalation.
• Verify patch state of the listed Windows builds against the MSRC advisory and flag unpatched Hyper-V hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.