A heap-based buffer overflow in the Virtual Hard Disk (VHD) Miniport Driver enables an attacker who has local access and is authorized on the system to gain higher privileges. The flaw classifies under CWE-122, indicating that improper buffer size handling can lead to arbitrary code execution with elevated rights. The vulnerability specifically allows an attacker to exploit the driver’s memory handling to achieve SYSTEM-level access, compromising system integrity and potentially enabling wide-ranging malicious activity.

A broad set of Windows operating systems is impacted, including Windows 10 releases 1607, 1809, 21H2, and 22H2; Windows 11 releases 23H2, 24H2, 25H2, 26H1, and the ARM64 variants; and various Windows Server editions from 2012 through 2025. All 32-bit and 64-bit builds of these products are affected, as documented in the provided CPE list.

The CVSS base score of 7 indicates a moderate to high severity. No EPSS score is available, so the likelihood of exploitation is uncertain, but the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local, requiring the attacker to be authenticated on the target machine or otherwise have the ability to load a malicious driver. Once the exploit is triggered, the attacker can elevate to SYSTEM privileges, enabling them to compromise the host at the highest level.