CVE-2017-0181

Hyper-V Remote Code Execution Vulnerability

CVE-2017-0181 is fixed in 6 products on 1 platform, first by KB4015219, released April 11, 2017. It is not reported as exploited. Patch Radar priority: Urgent.

Urgent
CVSS
7.6
Critical
Exploitation
None reported
Exploitation Less Likely
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0315
87th percentile

<p>A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker could run a specially crafted application on a guest operating system that could cause the Hyper-V host operating system to execute arbitrary code.</p> <p>An attacker who successfully exploited the vulnerability could execute arbitrary code on the host operating system.</p> <p>The security update addresses the vulnerability by correcting how Windows Hyper-V Network Switch validates guest operating system network traffic.</p>

Where it's fixed

ProductFixed inFixReleased
Microsoft
Windows 10 Version 1511 for x64-based Systems 10586.873 KB4015219 Apr 11, 2017
Windows 10 Version 1607 for x64-based Systems KB4015217 Apr 11, 2017
Windows 10 Version 1703 for x64-based Systems 15063.138 KB4015583 Apr 11, 2017
Windows 10 for x64-based Systems 10240.17354 KB4015221 Apr 11, 2017
Windows Server 2016 KB4015217 Apr 11, 2017
Windows Server 2016 (Server Core installation) KB4015217 Apr 11, 2017