CVE-2019-0717: Windows Hyper-V Denial of Service Vulnerability

Severity: medium (CVSS 5.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 5.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-08-14 · updated 2026-06-17
Weakness: CWE-20

Description

A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system. An attacker who successfully exploited the vulnerability could cause the host server to crash. To exploit the vulnerability, an attacker who already has a privileged account on a guest operating system, running as a virtual machine, could run a specially crafted application that causes a host machine to crash. The update addresses the vulnerability by modifying how virtual machines access the Hyper-V Network Switch.

Affected products

Microsoft Windows 10 Version 1607: 1809, 1903
Microsoft Windows Server 2016: 1903
Microsoft Windows Server 2019: all versions
Microsoft Windows 10: from 10.0.0 before publication — fixed in publication
Microsoft Windows 10 Version 1903 for x64-based Systems: from 10.0.0 before publication — fixed in publication
Microsoft Windows Server 2019: from 10.0.0 before publication — fixed in publication
Microsoft Windows Server, version 1903 (Server Core installation): from 10.0.0 before publication — fixed in publication

How to fix

Upgrade to a fixed version: Microsoft Windows 10 publication; Microsoft Windows 10 Version 1903 for x64-based Systems publication; Microsoft Windows Server 2019 publication; Microsoft Windows Server, version 1903 (Server Core installation) publication. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-0717 or the next vulnerability affects your stack