A use‑after‑free flaw in the Windows VHD miniport driver enables an authorized local attacker to execute code with the privileges of the operating system’s services, thereby escalating privileges. The defect, classified as CWE-416, occurs when the driver fails to release a memory reference after a VHD operation, allowing the attacker to manipulate control flow. As a result, an attacker who can trigger the flaw can obtain system‑level access and compromise confidentiality, integrity, or availability of the host.

Microsoft Windows 10 versions 1607, 1809, 21H2 and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H2 and 26H1; and all Windows Server editions 2012, 2012 R2, 2016, 2019, 2022 and 2025—including Server Core installations—are affected. CPE data confirms that the vulnerability exists on x86, x64, and ARM64 platforms for both client and server operating systems.

The flaw carries a CVSS score of 7.8, indicating high severity. Because an attacker must have local, authorized access and must be able to trigger the use‑after‑free condition, the exploitation scenario is limited to privileged users or compromised local processes. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, so while the exploitation risk is non‑negligible, it is not known to be actively exploited. Administrators should consider the risk significant in environments where VHD functionality is enabled and monitor for any local code execution attempts that could target the driver.