Windows VHD Driver CVE-2026-69611

Exploitation requires an authenticated local session with at least low-privileged (standard user) access to the target Windows system. The VHD Miniport Driver must be accessible, which is the default on all listed Windows editions including desktop and server variants. High attack complexity (AC:H) indicates a race condition or precise memory-layout requirement that cannot be reliably triggered without repeated attempts or heap-grooming techniques. No special feature enablement beyond default Windows configuration is required, but physical or remote interactive access (e.g., RDP) with a valid user account is a hard prerequisite. Exploitation is limited to local privilege escalation - remote unauthenticated exploitation is not possible per the AV:L/PR:L CVSS vector.

CVSS 7.0 (High) with AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a realistic, constrained exploitation scenario: the attacker must already have a local low-privileged account, and the high attack complexity (AC:H) suggests a race condition or precise heap manipulation is required, reducing opportunistic exploitation. No EPSS data was supplied, no POC is publicly identified, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. Despite the broad Windows version coverage, the AC:H constraint meaningfully reduces real-world exploitability compared to simpler kernel EoPs. The primary risk is insider threat actors or post-compromise lateral movement within Windows environments where VHD functionality is available, including Hyper-V hosts and developer workstations.

A low-privileged local user on a Windows Server 2025 Hyper-V host mounts a specially crafted .vhdx file and then triggers a race condition between concurrent I/O operations and driver cleanup routines in the VHD Miniport Driver, causing the kernel to access freed memory. By winning the race and controlling the freed memory region's contents, the attacker redirects execution to attacker-controlled code running in kernel context, elevating to SYSTEM. No public POC exists at time of analysis, so this attack requires non-trivial kernel exploitation skill.