CVE-2026-46655

A flaw was found in virtio-win. A low-integrity process can issue an IOCTL request to viosock.sys!VIOSockSelect with a maliciously crafted request that causes an integer overflow. This allows the process to circumvent bounds checking, resulting in a heap overflow in the NonPagedPool kernel heap. The flaw could be exploited to escalate privileges on Windows systems running this driver.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This flaw requires local access to a Windows guest with the virtio-vsock driver installed. The following steps reduce exposure:

1. Disable the viosock driver on guests that do not need VM socket communication. Stop the viosock service and set its startup type to Disabled. This eliminates the attack surface entirely and is the strongest interim mitigation.
2. Verify memory protections are active in the guest. These raise the cost of exploiting the heap overflow significantly.
3. Minimize guest-to-host attack surface on the hypervisor. Even a full guest kernel compromise is contained by the KVM boundary. Disable unnecessary virtio devices and limit PCI passthrough to reduce the risk of chaining with a separate host escape.