Windows VHD CVE-2026-102220

Exploitation requires the attacker to already possess authenticated local access with low privileges on the target Windows system (PR:L) and the ability to run code that interacts with the VHD miniport driver's I/O interface; the VHD/virtual disk subsystem must be reachable from the attacker's context. No user interaction is needed (UI:N) and the attack is low-complexity (AC:L). The principal limiting factor is that this is purely local (AV:L) - it cannot be triggered remotely and confers no initial access; it is only useful as a privilege-escalation stage after a separate foothold. Successful memory grooming to reclaim the freed kernel object is an implicit practical prerequisite for reliable code execution.

This is a locally-exploitable elevation-of-privilege flaw (CWE-416 use-after-free) in the Windows VHD miniport driver. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) indicates a low-complexity, local attack requiring only low existing privileges and no user interaction, yielding full confidentiality, integrity, and availability impact - the classic profile of a kernel driver bug used for sandbox escape or user-to-SYSTEM escalation. No EPSS score, SSVC decision, KEV listing, or POC indicator is present in the supplied data, so there is no exploitation probability signal to weigh against the severity. There is currently no evidence of active exploitation: no public exploit identified at time of analysis. The signals are internally consistent (local kernel UAF, authorized attacker, high technical impact), so this is a genuine patch-worthy privilege-escalation issue rather than an inflated score, but it is a second-stage vulnerability - an attacker must already have code execution on the host, which bounds its urgency relative to remote unauthenticated flaws. Note one metadata inconsistency: the input Tags include 'Denial Of Service', yet the vuln is described and scored as a full-impact elevation of privilege, not merely a DoS - treat the DoS tag with caution.

An attacker who already has a low-privileged foothold on a Windows host (e.g., a standard user account or code running inside a sandbox) runs a crafted process that drives the VHD miniport driver into a use-after-free condition. By grooming kernel memory to reclaim the freed object, the attacker manipulates kernel data to execute code or overwrite privileged structures, escalating to SYSTEM. No public exploit is identified at time of analysis, and no user interaction is required.