EUVD-2026-73048
GHSA-j2mx-rwf2-54gp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged user
-
DeliverySend crafted VHD request over network
-
ExploitTrigger heap overflow in VHD Miniport Driver
-
ExecutionCorrupt kernel heap structures
-
ImpactElevate to SYSTEM privileges
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already hold low-privilege authenticated access (PR:L) to a target running the Windows Virtual Hard Disk (VHD) Miniport Driver, then reach that driver over the network (AV:N) with a crafted request; no user interaction is needed (UI:N). Exploitation is gated by the need for valid credentials/foothold and is rated not automatable by SSVC, limiting scale. Affected are the VHD-handling components across Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1), and Windows Server 2012 through 2025; patched builds are enumerated in EUVD-2026-73048 (e.g., Server 2025 <10.0.26100.33438, Win11 24H2 <10.0.26100.9445), so unpatched pre-fix builds are the realistic exposure window. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 HIGH) describes a low-complexity, authenticated (PR:L) network-reachable flaw with total confidentiality, integrity, and availability impact - consistent with the SSVC 'Technical Impact: total' rating. However, the signals point away from imminent mass exploitation: SSVC lists Exploitation as 'none' and Automatable as 'no', KEV status is not set (no confirmed active exploitation), and no public exploit is identified. EPSS is low at 0.77% (53rd percentile), which aligns with the SSVC 'not automatable' judgement and suggests any exploitation would be targeted rather than widespread. Note a semantic tension worth flagging: the description characterizes this as privilege elevation ('elevate privileges over a network'), yet the vector is AV:N with S:U - a common Microsoft pattern where a network-delivered request drives a local EoP; treat the 'over a network' phrasing as the delivery path rather than a remote-code-execution primitive, and verify intended attack model with the MSRC advisory. Net: a genuinely serious flaw given the ubiquitous Windows footprint and total technical impact, but current telemetry indicates it is a patch-on-cycle priority, not an emergency, absent evidence of exploitation. |
| Exploit ScenarioDerived | An attacker with low-privilege authenticated access sends a crafted request that reaches the Virtual Hard Disk (VHD) Miniport Driver, triggering a heap-based buffer overflow (CWE-122) in kernel-mode driver memory. Successful corruption of heap structures lets the attacker elevate to full SYSTEM privileges, yielding total control (C:H/I:H/A:H) of the host. No public proof-of-concept exploit is identified at time of analysis, and exploitation is rated not automatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 22, 2026
Heap-based buffer overflow (CWE-122) in the Windows Virtual Hard Disk (VHD) Miniport Driver permits an attacker who already holds low-privilege authenticated access (PR:L) to send a crafted request over the network (AV:N, no user interaction) and gain elevated privileges, with total confidentiality, integrity and availability impact per the CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). All supported Windows client and server branches are in scope - Windows 10 (1607, 1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2, 26H1) and Windows Server 2012 through 2025 - so unpatched pre-fix builds represent the realistic exposure window. Risk is tempered by the requirement for a valid foothold/credentials and by CISA SSVC rating the issue non-automatable with no observed exploitation; EPSS is a modest 0.77% (53rd percentile) and no public exploit code has been identified at time of analysis, though vendor patches are available and should be applied on a normal priority cycle.
Earlier versions of this analysis (1)
Heap-based buffer overflow in the Windows Virtual Hard Disk (VHD) Miniport Driver allows a low-privilege, network-reachable attacker - following required user interaction - to escalate privileges to SYSTEM level, achieving full compromise (C:H/I:H/A:H) of the affected host. The vulnerability spans nearly every supported Windows version from Server 2012 through Server 2025 and Windows 10/11 across all major releases, creating an exceptionally broad attack surface. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis; however, Microsoft has released patches for all affected versions.
RemediationAI
Microsoft has released fixed builds, so the primary action is to apply the current cumulative update that brings each branch to or above its patched build, as enumerated by EUVD-2026-73048 and the MSRC guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69681: Windows Server 2025 to 10.0.26100.33438, Windows 11 24H2 and Windows Server 2025 (10.0.26100.x) to 10.0.26100.9445, Windows 11 25H2 to 10.0.26200.9445, Windows 11 26H1 to 10.0.28000.2954, Windows 11 23H2 to 10.0.22631.7582, Windows 10 1607 and Windows Server 2016 to 10.0.14393.9512, Windows 10 1809 and Windows Server 2019 to 10.0.17763.9245, Windows 10 21H2 to 10.0.19044.7725, Windows 10 22H2 to 10.0.19045.7725, Windows Server 2022 to 10.0.20348.5622, Windows Server 2012 to 6.2.9200.26349, and Windows Server 2012 R2 to 6.3.9600.23397. Because exploitation requires pre-existing low-privileged authenticated access over the network, the most effective compensating controls constrain that reachability while patching is staged: restrict SMB/RPC and VHD-image/file-share paths that can feed crafted virtual disk content into the driver to trusted systems only, and eliminate anonymous or broad guest access to shares that host VHD/VHDX images - the trade-off is reduced file-sharing flexibility and possible breakage of backup, imaging and Hyper-V deployment workflows that legitimately consume remote virtual disks. Where virtual disks are mounted from untrusted or user-supplied sources, disable such mounting or quarantine the images until they can be validated, accepting the operational cost of manual review; additionally, tighten local privilege assignments so that non-administrative accounts cannot mount or interact with virtual disk images or reach the storage stack over the network. Note that 32-bit/64-bit and Server Core SKUs are all affected, so inventory and patch both server and client estates, and treat hosts with ARM64 or legacy 2012/2012 R2 builds as elevated priorities since they are easily missed by automated patching. No vendor workaround fully substitutes for the patch, and no public exploit code has been identified at time of analysis, so no emergency out-of-band response is indicated - prioritize externally reachable and shared multi-tenant hosts first.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 19 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a classic heap-based buffer overflow (CWE-122) in the Windows Virtual Hard Disk miniport driver, the kernel-mode storage component that sits beneath the Virtual Disk Service and Hyper-V/VHD mounting stack and handles parsing of VHD/VHDX image metadata and data structures. Because heap allocations for disk-image buffers are sized from attacker-influenced fields without adequate bounds validation, a crafted request can overflow adjacent heap memory; kernel-mode corruption of this kind commonly yields controlled memory write primitives that an attacker can convert into SYSTEM-level privilege escalation inside the Windows kernel. Reachability is network-oriented (AV:N) with low attack complexity (AC:L) and no user interaction (UI:N), but the vector requires PR:L, meaning the adversary must already possess low-privileged authenticated access to the target before triggering the overflow - it is not a pre-authentication remote compromise. The CPE strings confirm the impacted platforms are operating-system builds (microsoft:windows_10_1607/1809/21h2/22h2 across x64, x86 and arm64), consistent with a defect shipped in the Windows kernel rather than a separate standalone product; ENISA EUVD-2026-73048 enumerates the exact pre-fix build ceilings, and Microsoft's MSRC update guide is the authoritative vendor source. Note that the elevation is only meaningful in a Windows privilege boundary context - a non-administrative user or service account on an affected host, or an attacker with network access to such an account, is the enabling condition.
Know when Windows 10 1607 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Authenticated foothold gives PR:L; low-complexity network-reachable driver overflow yields total kernel-level compromise, so C/I/A all High with no scope change.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges over a network.
Executive ViewAI
Microsoft Windows Virtual Hard Disk (VHD) Miniport Driver is affected by a high-severity privilege escalation vulnerability that spans all supported Windows client and server branches. An attacker with low-privilege authenticated access could exploit this flaw to gain elevated privileges, potentially compromising data confidentiality, integrity, and availability across the organization's Windows estate. Although no public exploit identified at time of analysis and CISA SSVC rates the issue non-automatable, the broad exposure and vendor-available patch make timely remediation a priority.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
More in Windows 10 1607
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Exploit-DB