Windows VHD Driver CVE-2026-81355

Requires the attacker to already have local, authenticated access as a low-privileged user (AV:L, PR:L) on an affected Windows build, and to trigger operations handled by the Virtual Hard Disk (VHD) miniport driver - the code path exercised when mounting/attaching or performing I/O against VHD/VHDX virtual disks. Exploitation is limited by high attack complexity (AC:H): reliably corrupting the kernel heap to achieve code execution requires heap grooming or winning a race, not a deterministic single request. No user interaction is required (UI:N). Affected default configurations span Windows 10 (1607 through 22H2), Windows 11 (23H2 through 26H1), and Windows Server 2012 through 2025 (including Server Core); patched builds are enumerated in EUVD (e.g. Server 2025 <10.0.26100.33438, Win10 22H2 <10.0.19045.7725).

This is a genuine but not high-urgency priority. The CVSS 3.1 base score of 7.8 (Microsoft-assigned) reflects total technical impact (C:H/I:H/A:H) but is gated by significant limiting factors: AV:L means the attacker must already have local code execution, PR:L means they need a valid low-privileged account, and AC:H signals a non-trivial exploit (heap grooming / race condition against the VHD miniport driver) rather than a reliable one-shot. All independent signals agree this is NOT a mass-exploitation threat: EPSS is very low at 0.21% (12th percentile), CISA SSVC scores Exploitation as 'none' and Automatable as 'no' (consistent with a local, non-wormable EoP requiring precise heap manipulation), and there is no KEV listing and no public POC. The one point of internal tension is the CVSS vector's S:C (scope change) combined with AV:L - a scope change is defensible for a kernel driver flaw that crosses the user/kernel security boundary, but many comparable Windows EoP bugs are scored S:U; this pushes the score higher than the local, high-complexity reality warrants. Net: a legitimate patch-in-normal-cycle local privilege-escalation/code-execution bug, valuable to an attacker as a post-compromise step, but not an emergency.

An attacker who already has a foothold as a standard user on a Windows host (via phishing, a stolen credential, or a separate RCE) crafts input that drives the Virtual Hard Disk miniport driver into a heap-based buffer overflow, corrupting kernel heap memory to gain code execution at a higher privilege level. No public exploit or POC has been identified at time of analysis, and the high attack complexity (AC:H) means reliable exploitation requires precise heap grooming or winning a race.