VHD Miniport Driver CVE-2026-109453

Exploitation requires the attacker to already possess local, authenticated access with low privileges (PR:L) to a Windows system whose in-box Virtual Hard Disk (VHD) miniport storage driver is present (default on Windows). The attacker must send crafted requests to the VHD driver to trigger the heap overflow; no user interaction is needed (UI:N). The primary limiting factors are the local-only attack vector (AV:L - no remote reach) and the high attack complexity (AC:H), which indicates a timing/race or precise heap-layout condition that makes reliable exploitation difficult and may require multiple attempts or specific system state.

This is a locally-exploitable elevation-of-privilege flaw (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L) in the Windows Virtual Hard Disk (VHD) Miniport Driver. The signals are consistent but point to a moderate, not emergency, priority: the attacker must already have local access and low-level privileges (PR:L), and the high attack complexity (AC:H) implies a race condition or a non-trivial heap-grooming requirement rather than a reliable one-shot trigger. Impact is high across confidentiality, integrity and availability (C:H/I:H/A:H) with unchanged scope, which is typical of a kernel-driver EoP yielding SYSTEM. No EPSS score, KEV listing, or public POC is present in the provided data, so there is NO evidence of active exploitation or available exploit code - this appears to be a vendor-disclosed (secure@microsoft.com) patch-cycle vulnerability rather than a known-exploited threat. Treat it as a standard patch-management item: important because the technical impact is kernel-level privilege escalation, but the local-only vector plus high complexity substantially limit real-world mass-exploitation risk. Note the data gap: no affected-build list or patched version is provided beyond the MSRC reference, so exact exposure cannot be confirmed from this input.

A low-privileged user or malware already running on a Windows host crafts input that triggers a heap-based buffer overflow in the VHD miniport driver, corrupting kernel heap memory to hijack execution flow and escalate to SYSTEM. The high attack complexity (AC:H) suggests the attacker must win a race or precisely groom the kernel heap, so exploitation is not guaranteed on each attempt. No public exploit code is identified at time of analysis.