Windows: Heap-based buffer overflow in VHD Miniport Driver

Summary

A heap-based buffer overflow in the Virtual Hard Disk (VHD) Miniport Driver of Windows allows an authorized local attacker to elevate privileges. The attacker needs a valid low-privileged account and local access, and exploitation is rated as high complexity. Successful exploitation could give the attacker high impact on confidentiality, integrity and availability (CVSS 3.1: 7.0, High).

Affected

• Windows 10 Version 1607 and Windows Server 2016 (incl. Server Core): builds 10.0.14393.0 before 10.0.14393.9612
• Windows 10 Version 1809: builds 10.0.17763.0 before 10.0.17763.9376
• Windows 10 Version 21H2: builds 10.0.19044.0 before 10.0.19044.7807
• Windows 10 Version 22H2: build range listed in the CNA record is inconsistent (see fixed versions)
• Windows 11 Version 23H2: builds 10.0.22631.0 before 10.0.22631.7652
• Windows 11 Version 24H2 and 25H2: builds 10.0.26100.0 before 10.0.26100.9711 and 10.0.26200.0 before 10.0.26200.9711
• Windows 11 Version 26H1: builds 10.0.28000.0 before 10.0.28000.3231
• Windows Server 2012 (incl. Server Core): builds 6.2.9200.0 before 6.2.9200.26434
• Windows Server 2012 R2 (incl. Server Core): builds 6.3.9600.0 before 6.3.9600.23470

Fixed in

• Windows 10 Version 1607 and Windows Server 2016: 10.0.14393.9612
• Windows 10 Version 1809: 10.0.17763.9376
• Windows 10 Version 21H2: 10.0.19044.7807
• Windows 10 Version 22H2: 10.0.19045.7807 (to be confirmed on the MSRC page, as the CNA record lists 10.0.19044.7807)
• Windows 11 Version 23H2: 10.0.22631.7652
• Windows 11 Version 24H2 and 25H2: 10.0.26100.9711 and 10.0.26200.9711
• Windows 11 Version 26H1: 10.0.28000.3231
• Windows Server 2012: 6.2.9200.26434
• Windows Server 2012 R2: 6.3.9600.23470
• KB numbers: Unknown. Check the MSRC Security Update Guide or the Microsoft Update Catalog for the correct KB per build.

Workaround

Unknown. No vendor workaround has been identified; applying the security update is the only confirmed mitigation.

Exploitation

• No confirmed exploitation in the wild was found.
• No public proof of concept was found.
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• EPSS score of 0.00252 indicates a low probability of exploitation.

Our recommendation

• Inventory all Windows 10 1607, Windows Server 2016 and other affected systems and verify that they are at or above the fixed build.
• Install the October 2026 security update on all affected systems; obtain the KB for each build from MSRC.
• Check the Microsoft lifecycle page for Windows 10 1607 and Windows Server 2016; plan an upgrade if the OS is out of support or no longer receives fixes.
• Until patched, limit interactive local logons to trusted users and do not mount untrusted VHD or VHDX files on affected systems.
• Monitor for unusual privilege changes or processes started by local accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-109453 msrc.microsoft.com
• Vulners NVD record CVE-2026-109453 vulners.com
• CIRCL CWE-122 overview vulnerability.circl.lu
• Strix CVE summary CVE-2026-109453 www.strix.ai
• Tenable plugin 365473 (bulletin reference) www.tenable.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 4 Nov 2026, 09:39.