CVE-2026-70252: Local Privilege Escalation via VHD Miniport Driver Use-After-Free

What happened

A use‑after‑free bug in the Windows Virtual Hard Disk (VHD) mini‑port driver was discovered. When a VHD file is opened and subsequently closed, the driver fails to clear a reference to a memory buffer. An attacker can then craft a malicious VHD that re‑allocates the freed buffer with controlled data, allowing execution of arbitrary code with elevated privileges.

Impact

The flaw can be triggered by any user with local access to the target machine. Successful exploitation results in the attacker gaining the privileges of the System account, enabling full control over the affected computer. The vulnerability is not exploitable over the network and requires the victim to run a malicious VHD file or a program that mounts it.

Mitigation

• Install the security update released by Microsoft for CVE-2026-70252 (included in the latest cumulative update for Windows 10/11 and Windows Server 2022).
• Ensure that the VHD mini‑port driver is updated to the patched version (check driver version 1.0.0.0 or later).
• Disable or restrict the ability to mount VHD files for non‑trusted users if possible.

Microsoft recommends applying the cumulative update immediately to prevent exploitation.

Detection

Monitor for unusual privilege escalation events, such as sudden creation of SYSTEM‑level processes by users who normally run with limited rights. Watch for the use of the “vmhgfs” or “vhd” driver in the Windows event logs, and look for repeated “VHD driver unload” errors that may indicate a use‑after‑free attempt.