Windows VHD Driver CVE-2026-59125

Exploitation requires an existing local authenticated session with at minimum standard user (low-privilege) rights, as confirmed by the CVSS PR:L metric - unauthenticated or remote exploitation is not possible per the AV:L vector. The target driver - the VHD Miniport Driver - must be loaded and active; it is present by default on all affected Windows builds and is activated whenever VHD/VHDX disk operations occur, including in Hyper-V, Windows Sandbox, and virtual disk mounting scenarios. The CVSS AC:H metric confirms exploitation is not straightforward: a race condition or equivalent timing-dependent condition must be won, limiting reliable exploitation to attackers with kernel-level exploit development capability and the ability to attempt multiple tries. The vulnerability does not require user interaction (UI:N). Systems without any local user access beyond administrative accounts have substantially reduced exposure. A failed exploitation attempt may trigger a kernel driver crash (consistent with the DoS tag), producing a detectable system crash artifact.

The CVSS 7.0 score with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H accurately encodes a meaningful local privilege escalation: network-remote exploitation is not possible, an existing authenticated session is required (PR:L), and high attack complexity substantially reduces exploitation reliability. CVE-2026-59125 does not appear in the CISA KEV catalog and no public proof-of-concept has been identified, indicating this has not been weaponized at scale as of the data provided. EPSS data was not included in the input and exploitation probability is therefore unquantified. Despite the local-only vector, the breadth of affected platforms - spanning fifteen distinct Windows SKUs and build branches - makes this a high-surface issue in enterprise environments. Priority should be elevated for shared-access systems such as Remote Desktop Session Hosts, VDI environments, Hyper-V hosts, and any multi-tenant Windows deployment where untrusted users hold local logon rights, since these contexts provide the prerequisite low-privilege foothold. The 'Denial of Service' tag in addition to privilege escalation suggests a failed exploitation attempt may cause a driver crash, creating a detectable blue-screen artifact useful for threat hunting.

An attacker with a standard user account on a Windows system initiates concurrent or specially sequenced VHD Miniport Driver operations designed to free a kernel object while a second code path still holds a reference to it. By precisely timing a subsequent heap allocation to reclaim the freed memory with attacker-controlled content, the attacker redirects kernel execution flow and gains SYSTEM-level privileges. No public proof-of-concept exploit exists at time of analysis, meaning successful exploitation currently requires specialized kernel exploitation knowledge and ability to reliably win the race condition.