VHD Miniport Driver CVE-2026-69549

Exploitation requires a valid authenticated local user account with at least standard (low-privilege) access on the target system (PR:L, AV:L per CVSS). The attacker must be able to interact directly with the VHD Miniport Driver, typically through IOCTL calls accessible to standard users when the VHD/VHDX subsystem is loaded - no special VHD configuration or administrative rights are required to reach the vulnerable code path. High attack complexity (AC:H) means the exploit must satisfy specific memory layout or timing conditions, making reliable exploitation non-trivial and preventing automated mass exploitation. This vulnerability cannot be triggered by remote unauthenticated attackers. Systems that restrict all local interactive logon to administrator accounts (e.g., hardened server configurations with no standard user shell access) effectively eliminate the realistic attacker population.

The CVSS 7.0 score with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H reflects an authentic local privilege escalation pathway with important limiting factors. The AV:L metric confirms exploitation cannot be triggered remotely; the AC:H rating indicates non-trivial prerequisites such as specific memory layout conditions or timing dependencies, substantially reducing the risk of automated or mass exploitation. The full C:H/I:H/A:H impact triad applies only on successful exploitation, which the AC:H metric marks as difficult to reliably achieve. No EPSS score was provided in the source data, and the vulnerability does not appear in the CISA KEV catalog, with no known public proof-of-concept code. Despite the breadth of affected Windows versions, the local-only attack vector limits the realistic threat to insiders, post-compromise attackers pivoting laterally, or compromised shared endpoint environments. This is a genuine privilege escalation risk warranting prompt patching but not emergency out-of-band response for most organizations.

An attacker with a standard Windows local account crafts malicious IOCTL requests targeting the VHD Miniport Driver, triggering an out-of-bounds read that leaks kernel memory including pointer values. Using the leaked addresses to defeat ASLR, the attacker constructs a follow-on payload achieving SYSTEM-level code execution. No public exploit code exists; the AC:H CVSS rating indicates successful exploitation requires precise memory layout engineering beyond trivial tooling.