VHD Miniport Driver EUVD-2026-99204

Exploitation requires the attacker to already hold valid low-privileged local code execution on the target Windows host (PR:L, AV:L) - there is no remote or network-facing attack surface. The attacker must interact with the Virtual Hard Disk (VHD) Miniport Driver to trigger the use-after-free, which involves winning a timing/race window (reflected as AC:H), making reliable exploitation harder than a deterministic bug. No user interaction by a victim is required (UI:N). Limiting factors: the local-only vector, the required existing foothold, and the high attack complexity together constrain this to post-compromise privilege escalation rather than initial access. The VHD miniport is present by default across supported Windows editions, so no special non-default configuration is needed once local access is obtained.

This is a genuine but moderate-priority local privilege escalation in the Windows VHD Miniport Driver (vhdmp). The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0 HIGH) is internally consistent with the description's 'elevate privileges locally' and CWE-416 Use-After-Free: the attacker must already have a local, low-privileged foothold (PR:L) and must win a race/timing condition typical of UAF bugs, which the vendor reflects as AC:H. There is no KEV listing and no public exploit referenced, so exploitation status is 'no public exploit identified at time of analysis' - this is not a drop-everything issue. The high complexity (AC:H) and local-only vector (AV:L) meaningfully reduce real-world risk versus a remote unauthenticated flaw, but the triple C:H/I:H/A:H impact means a successful exploit yields full SYSTEM-level compromise. No EPSS score, SSVC decision, or POC indicator was provided in the input, so probabilistic exploitation likelihood cannot be quantified; absence of these signals is not evidence of low risk, only of incomplete telemetry. Note one tagging tension: the input Tags include 'Denial Of Service,' yet the description and CVSS both frame this as privilege elevation with full A:H - a UAF can plausibly cause both, but the primary documented impact is EoP, not DoS.

A low-privileged user who already has code execution on a Windows host (e.g., via a standard user account, a sandboxed process, or a compromised service) triggers the use-after-free in the VHD miniport driver by manipulating virtual hard disk operations, then wins the timing window to reuse the freed kernel object. Because the flaw is in a kernel-mode driver, successful exploitation elevates the attacker to SYSTEM. No public exploit code is referenced, and the vendor-assigned AC:H indicates a non-trivial race condition that complicates reliable weaponization.