Microsoft Windows: Stack-based buffer overflow in VHD Miniport Driver

Summary

A stack-based buffer overflow in the Virtual Hard Disk (VHD) Miniport Driver of Windows allows an authorized local attacker to execute code. The attack is local and requires low privileges and high attack complexity, so it is not reachable from the internet. Despite the title "Remote Code Execution", the CVE record and CVSS vector (AV:L) describe a local attack. CVSS 3.1 base score is 7.0 (HIGH).

Affected

• Windows 10 Version 1607: 10.0.14393.0 to < 10.0.14393.9688
• Windows 10 Version 1809: 10.0.17763.0 to < 10.0.17763.9487
• Windows 10 Version 21H2: 10.0.19044.0 to < 10.0.19044.7846
• Windows 10 Version 22H2: 10.0.19045.0 to < 10.0.19045.7846
• Windows 11 Version 23H2: 10.0.22631.0 to < 10.0.22631.7711
• Windows 11 Version 24H2: 10.0.26100.0 to < 10.0.26100.9974
• Windows 11 Version 25H2: 10.0.26200.0 to < 10.0.26200.9974
• Windows 11 Version 26H1: 10.0.28000.0 to < 10.0.28000.3501
• Windows 11 Version 26H2: 10.0.26300.0 to < 10.0.26300.9974
• Windows Server 2016 (including Server Core): 10.0.14393.0 to < 10.0.14393.9688
• Windows Server 2019 (including Server Core): 10.0.17763.0 to < 10.0.17763.9487
• Windows Server 2022: 10.0.20348.0 to < 10.0.20348.5870

Fixed in

• Install the Windows cumulative update that brings the build to the first fixed version listed above (for example 10.0.14393.9688, 10.0.17763.9487, 10.0.19044.7846, 10.0.19045.7846, 10.0.22631.7711, 10.0.26100.9974, 10.0.20348.5870).
• The KB number per build is unknown; check the MSRC Security Update Guide.

Workaround

Unknown. No vendor workaround was found in the sources.

Exploitation

• No public proof of concept found.
• No confirmed exploitation of this specific CVE found.
• The CVSS vector marks exploit maturity as unproven (E:U).

Our recommendation

• Install the November 2026 Windows security updates on all affected systems, prioritising terminal servers, file servers and shared PCs.
• Check whether Windows 10 1607, 1809 and 21H2 hosts still receive security updates (ESU or otherwise); if not, plan an upgrade.
• Restrict local logon to necessary users and limit who can mount VHD/VHDX files.
• Verify the fixed KB numbers in the MSRC guide before rollout.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-119849 msrc.microsoft.com
• CVE.org record CVE-2026-119849 www.cve.org
• Strix mirror CVE-2026-119849 (version list to verify) www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 08:41.