Windows VHD Driver EUVD-2026-73374

Exploitation requires a valid local user account on the target Windows system (PR:L); remote unauthenticated exploitation is not possible given the AV:L vector. The VHD miniport driver is loaded by default on all supported Windows editions, so no special configuration is needed - this affects default installations. No user interaction is required (UI:N). The primary limiting factor is the need for initial local access: attackers must first establish a foothold (via malware execution, stolen credentials, or physical access) before this vulnerability can be leveraged for privilege escalation. Domain-joined systems with restricted logon policies limit the pool of accounts that can trigger the flaw, but do not eliminate it.

With a CVSS 3.1 base score of 7.8 and a vector of AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, this is a high-severity local privilege escalation that requires only a standard user account - no elevated permissions needed to trigger the vulnerability. The attack complexity is low, and the exploit is fully local (no network exposure), which limits the initial access vector but not the post-exploitation impact. No public exploit code has been identified and the CVE is not listed in CISA KEV, suggesting exploitation remains theoretical or closely held at this time. However, the ubiquity of affected Windows versions across enterprise fleets means the blast radius is very large if weaponized; even a mid-sized IT operation should treat this as urgent patching priority when combined with any social-engineering or phishing vector that delivers initial local access. EPSS data is not provided in the source intelligence, so probabilistic exploitation likelihood cannot be independently quantified, but the low-complexity, no-UI-interaction characteristics historically correlate with rapid weaponization once details are public.

An attacker who has obtained a low-privileged local session on a Windows host - via phishing payload, compromised service account, or lateral movement - submits crafted VHD-related I/O control requests to the VHD miniport driver, triggering a use-after-free condition in kernel memory. By controlling the freed memory region's contents, the attacker redirects kernel execution flow, elevating to SYSTEM-level privileges and gaining full control of the operating system. No public proof-of-concept has been identified at time of analysis, but the AC:L CVSS rating suggests exploitation is technically straightforward once the vulnerability mechanics are understood.