Executive brief
The Virtual Hard Disk (VHD) Miniport Driver is a Windows component that manages storage devices and virtual disks. An authorized local attacker can exploit an out-of-bounds read vulnerability in this driver to gain elevated system privileges, potentially giving them complete control over the affected computer.
Technical details
This vulnerability is an out-of-bounds read in the Virtual Hard Disk (VHD) Miniport Driver, a kernel-mode component responsible for handling VHD storage operations. The vulnerability requires the attacker to have local access with authenticated privileges to trigger it. Successful exploitation allows privilege escalation from a lower privilege context to system/kernel level. The out-of-bounds read may allow an attacker to leak sensitive kernel memory or manipulate driver state to achieve code execution with elevated privileges. A patch has been released by Microsoft for this issue.
Affected products
- Microsoft Windows <UNKNOWN>
Timeline
- 2026-09-08: disclosed