Windows VHD Miniport CVE-2026-70574

Exploitation requires a low-privileged authenticated local account on an affected Windows system - the CVSS PR:L metric confirms standard user-level access is sufficient with no administrator rights needed. The VHD Miniport Driver must be present, which is the default state on all affected Windows installations that include virtual disk support (covering effectively all modern Windows deployments). No user interaction (UI:N) is required beyond the attacker executing their own payload. Exploitation is strictly limited to local access - the AV:L vector rules out any remote unauthenticated exploitation path. Attack complexity is low (AC:L), meaning no race conditions, specific timing windows, or special environmental configuration states are required to trigger the vulnerability.

The CVSS 7.8 score with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H characterizes a realistic local privilege escalation with low attack complexity, no required user interaction, and full-compromise impact - a profile that maps directly to common post-exploitation techniques used after initial access. The absence from CISA KEV and lack of identified public exploit code suggest it has not yet seen mass exploitation campaigns; however, the simplicity of the required conditions (any low-privilege local account, default driver availability) means exploitation risk rises sharply once proof-of-concept code surfaces. Given that VHD/VHDX functionality is default-on across enterprise Windows deployments, even a mid-sized municipal IT team in tczew should treat this as urgent patching given how straightforwardly a standard user account converts to SYSTEM access. The version breadth - from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025 - amplifies organizational risk, particularly for environments with lagging patch cycles or extended-support licensing.

A threat actor who has obtained a low-privileged Windows account - via phishing, credential stuffing, or an earlier exploitation step - crafts a malicious I/O request to the VHD Miniport Driver on an unpatched system, triggering the out-of-bounds read to leak kernel memory contents. The attacker uses the leaked data to defeat ASLR and constructs a follow-on exploit that escalates from standard user to SYSTEM, after which they can disable endpoint defenses, harvest credentials from LSASS, and pivot laterally within the network. No public exploit code has been identified at time of analysis.