Windows: Use-after-free in VHD miniport driver allows local privilege escalation

Summary

The Windows VHD miniport driver, which handles virtual hard disk images, contains a use-after-free flaw (CWE-416) that allows an authorized local user to elevate privileges. An attacker needs a low-privileged account on the system and no user interaction, but could then gain high impact on confidentiality, integrity and availability. The flaw is not directly reachable from the internet and matters mainly once an attacker already has a foothold, for example through phishing or a compromised account.

Affected

• Windows 10 Version 1607 (builds before 10.0.14393.9612) - Windows Server 2016 (builds before 10.0.14393.9612) - Windows 10 Version 1809, 21H2, 22H2 and Windows 11 Version 23H2, 24H2, 25H2, 26H1, 26H2 (builds listed in the CVE record) - Windows Server 2012 and 2012 R2 (builds listed in the CVE record)

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: build 14393.9612 via KB5126868, released 13 October 2026 - Other versions: fixed builds as listed in the CVE record (for example 10.0.22631.7652 for 23H2 and 10.0.26100.9711 for 24H2); verify against the MSRC advisory

Workaround

Unknown. No workaround is documented; check the MSRC advisory for mitigation guidance.

Exploitation

• No evidence of exploitation in the wild found; CISA SSVC assessment lists exploitation as none and automatable as no. - No public proof-of-concept found. - EPSS is about 0.4 percent. - CISA KEV status not confirmed.

Our recommendation

• Install the October 2026 security update on all affected Windows 10 1607, Windows Server 2016 and other listed systems, prioritising servers and multi-user machines. - Install the servicing stack update (KB5126649) before the cumulative update, per Microsoft guidance; verify this against the MSRC advisory. - Plan an upgrade for Windows 10 LTSB 2016 clients, since Microsoft's release-health page states that end of updates applies; this conflict is unresolved. - Check the MSRC advisory and CISA KEV before approving changes. - Verify that the full October 2026 bundle is installed and monitor for privilege escalation activity.}},

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide msrc.microsoft.com
• threatint CVE record cve.threatint.com
• Vulners CVE record vulners.com
• Strix CVE record www.strix.ai
• NinjaOne KB5126868 www.ninjaone.com
• Microsoft Update Catalog KB5126868 www.catalog.update.microsoft.com
• Microsoft Learn: Windows 10 1607 and Server 2016 release health learn.microsoft.com
• Tenable plugin 365471 www.tenable.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 05:13.