Windows VHD Miniport Driver EUVD-2026-73015

Exploitation requires an authenticated local user session - the attacker must have at least a standard (low-privileged) Windows user account on the target system (PR:L). The trigger surface is the VHD Miniport Driver's handling of virtual disk operations, likely invocable by any user who can mount a VHD/VHDX file (a default capability on Windows 10/11). No elevated privileges, no network access, and no user interaction from a second party are required. Exploitation is local only (AV:L) and does not require non-default configuration. The primary limiting factor is the requirement for an existing local user account; this is not remotely exploitable over a network without a prior foothold.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8 High) accurately reflects a local privilege escalation requiring only low-privileged access with no complexity or user interaction. In practice, this is a meaningful post-exploitation or insider-threat primitive: any standard Windows user account can be leveraged to achieve SYSTEM. The breadth of affected versions - from Windows Server 2012 to Windows Server 2025 and Windows 10/11 across all major release branches - amplifies aggregate risk considerably. No EPSS data was provided and neither KEV status nor public POC availability is confirmed, so exploitation is not confirmed as active. However, local privilege escalation in the Windows kernel storage stack is a well-understood attacker objective, particularly in ransomware chains and red-team engagements targeting Hyper-V hosts. The patch is available from Microsoft and should be prioritized for endpoint and server fleets, especially in shared or multi-tenant environments where user-level compromise is a realistic stepping stone.

A low-privileged user logged into a Windows endpoint or Hyper-V host mounts a specially crafted VHD/VHDX file, triggering the heap overflow in vhdmp.sys. The overflow corrupts adjacent kernel heap structures, allowing the attacker to redirect execution flow and obtain a SYSTEM-level token, achieving full control of the machine. No public POC has been identified at time of analysis, but the local nature and AC:L rating suggest the exploit would be reliable once developed.