MSRC-CVE-2026-42915 — Microsoft Windows VMSwitch Denial of Service Vulnerability

Summary

Impact: Denial of Service. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, the attack vector is adjacent (AV:A). What does that mean for this vulnerability?
An authenticated attacker could exploit this vulnerability with LAN access.

Security updates
10.0.20348.5256 — https://support.microsoft.com/help/5094128
10.0.19044.7417 — https://support.microsoft.com/help/5094127
10.0.26100.32995 — https://support.microsoft.com/help/5094125
10.0.26200.8655 — https://support.microsoft.com/help/5094126
10.0.22631.7219 — https://support.microsoft.com/help/5093998
10.0.28000.2269 — https://support.microsoft.com/help/5095051

Vulnerabilities 1

Medium 5.5

CVE-2026-42915

Microsoft Windows VMSwitch Denial of Service Vulnerability

Incorrect calculation of buffer size in Windows VMSwitch allows an authorized attacker to deny service locally.

Microsoft Windows Server 2022 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows

Jun 9, 2026

Revision history

2026-06-23 #3
Updated an acknowledgement. This is an informational change only.
2026-06-16 #2
Corrected the CVE description and title. This is an informational change only.
2026-06-09 #1
Information published.

References

CVE-2026-42915 Microsoft Windows VMSwitch Denial of Service Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-42915
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss