Microsoft Windows EUVD-2026-43768

Exploitation requires the attacker to already have authenticated local access with low privileges (PR:L) and the ability to execute code on the target host - this is a local elevation-of-privilege flaw, not remotely reachable (AV:L). The attack path involves interacting with the VHD Miniport Driver, meaning the attacker must attach/mount or otherwise feed a crafted Virtual Hard Disk (.vhd/.vhdx) image to trigger the heap overflow. Limiting factors: no remote exploitation, a valid local account or existing foothold is required, and the payoff is escalation to SYSTEM rather than initial access; no special non-default feature toggle is indicated beyond the always-shipped VHD miniport driver. No user interaction is required (UI:N) and complexity is low (AC:L).

The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local, low-complexity attack requiring only low privileges and no user interaction, yielding full confidentiality, integrity, and availability impact - a classic reliable local EoP profile. Because the attack vector is local, this is a post-compromise/second-stage risk rather than an internet-facing threat, which tempers urgency relative to a remote RCE. No EPSS score was provided, there is no KEV listing, and no public exploit is identified at time of analysis, so real-world exploitation pressure is currently unproven; however, kernel driver heap overflows are historically attractive for exploit development, and the very broad Windows footprint makes this a meaningful patch-cycle priority wherever low-privileged users can execute local code. No signals conflict - the local CVSS vector is consistent with the 'elevate privileges locally' description.

A low-privileged user who already has local access (for example a standard user on a shared terminal/session-host server, or malware running in a limited context) crafts or attaches a malicious VHD image that triggers the heap overflow in the miniport driver. By grooming the kernel heap and overwriting adjacent pool structures, the attacker escalates from their limited account to SYSTEM. No user interaction is required and attack complexity is low, though the attacker must first obtain local code execution; no public exploit is identified at time of analysis.