VHD Miniport Driver EUVD-2026-100381

Exploitation requires the attacker to already possess authenticated low-privileged local access (PR:L) to a Windows system whose Virtual Hard Disk (VHD) Miniport Driver is reachable - i.e., the attacker must be able to submit I/O (e.g., mount/attach operations or device IOCTLs) to the VHD storage stack. Exploitation is further limited by High attack complexity (AC:H): as a heap-based buffer overflow, reliable control typically depends on heap-layout grooming or winning a timing/race window, making success non-deterministic. There is no network vector and no user-interaction requirement (UI:N); the key limiting factors are the need for an existing local account and the probabilistic nature of heap corruption, not any non-default configuration.

This is a moderate-priority local privilege escalation rather than a top-tier emergency. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) tells a consistent story: the attacker must already be running code as an authenticated low-privileged local user (PR:L, AV:L), and exploitation is gated by high attack complexity (AC:H), which for a heap-based overflow (CWE-122) typically implies non-deterministic conditions such as heap grooming or a race window that cannot be reliably won every attempt. The payoff if successful is full compromise of the host (C:H/I:H/A:H), consistent with driver-level/kernel code execution and privilege elevation. No exploitation-probability or active-exploitation signals are present in the supplied data: there is no EPSS score, no CISA KEV listing, and no POC reference, so by the precision rules this is 'no public exploit identified at time of analysis.' No SSVC decision data was provided either. The signals are internally consistent (no contradictions between vector and description - both agree this is local and requires some privilege), so the main caveat is simply that real-world exploitability is dampened by AC:H and the need for an existing foothold. Net: patch in normal cycle prioritized by exposure to untrusted local users, but this is not a drop-everything network-exploitable flaw.

An attacker who already has a low-privileged foothold on a Windows host (for example via a phished user account or a compromised service) invokes the vulnerable VHD Miniport Driver through crafted I/O to trigger the heap overflow, corrupting kernel/driver heap structures to execute code at SYSTEM. Because attack complexity is High, the attacker likely must perform heap grooming or win a race condition, so exploitation may require multiple attempts. No public exploit code was identified in the provided data.