Windows VHD Driver CVE-2026-69384

Exploitation requires a local session on the affected Windows system - this includes physical console access, a Remote Desktop Protocol session, an SSH-forwarded shell, or any local user-mode process executing under a standard (non-administrator) account. The VHD Miniport Driver is present and accessible by default across all affected Windows SKUs; no special configuration is needed to expose the vulnerable code path. No user interaction is required beyond the attacker's own action of submitting the malformed request. The primary constraint limiting exploitation is the local attack vector (AV:L): the vulnerability is not network-reachable and requires some form of prior local execution foothold. In multi-user environments where untrusted parties hold local sessions - RDS farms, shared VDI pools, Hyper-V hosts, or Windows systems accessible via standard user accounts - any such user can potentially trigger the crash with no privilege escalation required beforehand.

The CVSS 7.1 score is appropriate for a local, availability-only vulnerability; the scope change (S:C) accounts for the fact that a kernel crash terminates the entire Windows host rather than just the VHD subsystem. The AV:L/PR:N combination is the most operationally significant aspect: no elevated privileges are required to invoke the vulnerable driver path, meaning any local session holder - including sandboxed processes, guest accounts, or standard-user RDP sessions - could trigger the crash. EPSS data is not available in the provided intelligence, and the vulnerability does not appear in the CISA KEV catalog, suggesting it has not yet been exploited in the wild. In high-density shared-access environments such as Remote Desktop Services farms, VDI deployments, or Hyper-V hosts - settings where even a mid-sized municipal IT team in malbork may operate dozens of multi-user Windows Server sessions - the no-privilege-required local vector meaningfully elevates the practical risk compared to a pure single-user workstation context. The availability-only impact (C:N/I:N) and local-only attack vector prevent this from reaching critical severity, but the breadth of affected products across 15 Windows SKUs spanning nearly a decade of releases makes patch coverage a non-trivial logistics task.

An untrusted standard-user account on a Windows Server 2025 Remote Desktop Services host submits a specially crafted VHD-related IOCTL to the VHD Miniport Driver from within their user session. The driver dereferences a null pointer, triggering an unhandled kernel exception that crashes the entire server, disconnects all active RDP sessions, and causes a system restart - constituting a complete availability denial for all concurrent users. No public proof-of-concept code has been identified at time of analysis, so the precise triggering mechanism is not publicly confirmed.