OnlyPatch
Virtual Hard Disk (VHD) Miniport Driver

CVE-2026-59125 — Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability

Important CVSS 7 EPSS 0.00246 🔬 Patch diffed 2026-08 archive

Executive Summary

Use after free in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.

Overview

7
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
Category Elevation of Privilege
Released Aug 11 2026
Last Updated Aug 11 2026
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known
EPSS Score 0.00246 — 0.16011 percentile
NVD CVSS 7 HIGH — matches MSRC

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
ATTACK VECTOR
Local
ATTACK COMPLEXITY
High
PRIVILEGES REQUIRED
Low
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Unproven
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 6.1

EPSS Score

0.00246
probability of exploitation in the next 30 days
0.16011 percentile - updated 2026-08-14
View on FIRST.org

Affected Products

18 affected products
Product KB Article Severity Impact Restart Required
Windows 10 Version 1607 for 32-bit Systems 5120418 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1607 for x64-based Systems 5120418 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for 32-bit Systems 5120238 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 1809 for x64-based Systems 5120238 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for 32-bit Systems 5120249 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for ARM64-based Systems 5120249 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 21H2 for x64-based Systems 5120249 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for 32-bit Systems 5120249 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for ARM64-based Systems 5120249 (Security Update) Important Elevation of Privilege Yes
Windows 10 Version 22H2 for x64-based Systems 5120249 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for ARM64-based Systems 5120240 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 23H2 for x64-based Systems 5120240 (Security Update) Important Elevation of Privilege Yes
Windows 11 Version 24H2 for ARM64-based Systems 5120994 (Security Hotpatch Update) 5121003 (Security Update) Important Elevation of Privilege 5101650 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26100.9106 10.0.26100.9168 Yes None Windows 11 Version 24H2 for x64-based Systems 5121003 (Security Update) 5120994 (Security Hotpatch Update) Important Elevation of Privilege 5101650 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26100.9168 10.0.26000.9106 Yes None Windows 11 Version 25H2 for ARM64-based Systems 5121003 (Security Update) 5120994 (Security Hotpatch Update) Important Elevation of Privilege 5101650 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26200.9168 10.0.26100.9106 Yes None Windows 11 Version 25H2 for x64-based Systems 5121003 (Security Update) 5120994 (Security Hotpatch Update) Important Elevation of Privilege 5101650 Base: 7.0 Temporal: 6.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C 10.0.26200.9168 10.0.26100.9106 Yes None Windows 11 Version 26H1 for ARM64-based Systems 5121000 (Security Update) Important Elevation of Privilege Yes
Windows 11 version 26H1 for x64-based Systems 5121000 (Security Update) Important Elevation of Privilege Yes
Windows Server 2016 5120418 (Security Update) Important Elevation of Privilege Yes
Windows Server 2016 (Server Core installation) 5120418 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 5120238 (Security Update) Important Elevation of Privilege Yes
Windows Server 2019 (Server Core installation) 5120238 (Security Update) Important Elevation of Privilege Yes

Patches

5 patches
Article Type Restart
5120418 Security Update Yes
5120238 Security Update Yes
5120249 Security Update Yes
5120240 Security Update Yes
5121000 Security Update Yes

Patch Diff

ghidriff · vhdmp.sys (KB5121003)

Rundown-nesting use-after-free in vhdmp.sys VhdmpiQueueIoRequest. The function read Request->VirtualDisk->Parent (+0xc8) and acquired only the parent's inner rundown (+0x610), never pinning the virtual disk (+0xd8) it read that pointer from. A concurrent detach frees the disk in the window, so the rundown acquire and the prefetch-state read (+0x5f8) operate on reclaimed pool; VhdmpiRecordForPrefetchWorker then performs an interlocked increment and an indexed 8-byte write through the freed block. Attach is unprivileged and both threads belong to the same user, so the race is self-staged. Patch acquires the disk rundown first and releases it last -- but is gated behind Feature_3417294137, so the vulnerable path still ships in the patched binary and runs when the flag is off. A sibling site at Parent+0x50 on the write path has the same missing-outer-pin shape and was not changed. Full ghidriff (10.0.26100.8972 -> .9168) shows 5 added / 7 modified functions and TWO new CFR flags: Feature_3417294137 (prefetch rundown reorder) and Feature_1070577979 (backing-store access, new VhdmpiReleaseBackingStoreAccessLocked helper). VhdmpiQueueIoRequest matched at only 28%.

Pre-patch version 10.0.26100.8972
Post-patch version 10.0.26100.9168
Function Address Change Note
VhdmpiQueueIoRequest 140004cc0 code (rundown acquire reordered, gated on Feature_3417294137) Pre-patch reads VirtualDisk->Parent at +0xc8 and acquires only Parent+0x610. Patch adds ExAcquireRundownProtection on VirtualDisk+0xd8 before the parent access and releases it last. Both branches ship in 10.0.26100.9168; the original code runs when the CFR flag is disabled.
VhdmpiAcquireBackingStoreAccessLocked / VhdmpiReleaseBackingStoreAccessForSecurityContext code (second lifetime fix, gated on Feature_1070577979) Found only by the full ghidriff run, not by targeted decompilation of VhdmpiQueueIoRequest. The patch adds a new VhdmpiReleaseBackingStoreAccessLocked function and modifies both the acquire and the security-context release path, behind a SECOND CFR flag Feature_1070577979. Same class of change as the prefetch fix -- acquire/release ordering on a shared object -- but a distinct code path. Whether this is part of CVE-2026-59125 or a separate silent fix is not established.
VhdmpiRecordForPrefetchWorker sink (unchanged) Dereferences PrefetchState+0x98 for the log segment, then LOCK-increments [seg+0x10] and writes [seg+0x18+idx*8]. When the state is freed this is an atomic increment plus an 8-byte write into reclaimed pool, with the index derived from the freed contents.
VhdmpiQueueIoRequest (write path, Parent+0x50) NOT changed -- variant lead Same function, ~40 lines earlier and outside the feature gate: reads VirtualDisk->Parent at +0xc8 with no disk pin, then acquires Parent+0x50. Byte-identical in both builds. Independent exploitability not established.
View full diff report View RCA report

Attack Path

Rundown-nesting use-after-free: an I/O thread follows VirtualDisk->Parent without pinning the disk, while a concurrent detach frees it

Attack path for CVE-2026-59125 Rundown-nesting use-after-free: an I/O thread follows VirtualDisk->Parent without pinning the disk, while a concurrent detach frees it Thread A: VHD I/O Virtual disk (+0xd8) Parent surface (+0x610) Thread B: detach Attach a VHD/VHDX the attacker owns, then issue reads/writes 1 Attach is unprivileged by design. I/O reaches VhdmpiQueueIoRequest @ 140004cc0 via VhdmpParserStartIo / VhdmpiExecuteScsi / VhdmpiIssueLowerIoContext -- every read and write to the mounted volume passes through it. Reads Request->VirtualDisk->Parent at +0xc8 with NO disk rundown held 2 The parent pointer lives inside the virtual disk's own allocation. Nothing pins that allocation at this point. Concurrent detach drains the disk rundown (+0xd8) and frees the disk 3 Same unprivileged user. Process-level detach is an ordinary operation and can be retried in a loop, so the window is attacker-timed rather than incidental. ExAcquireRundownProtection(Parent + 0x610) on reclaimed pool 4 Only the inner rundown is taken. The nesting rule -- pin the object you used to reach the inner one -- is violated, so the acquire itself writes into memory that has already been returned. PrefetchState read from +0x5f8, Ready byte checked at +0xac 5 Both reads come out of the freed allocation. VhdmpiRecordForPrefetchWorker: LOCK inc [seg+0x10], write [seg+0x18+idx*8] 6 Atomic increment plus an 8-byte write, index derived from the freed block's own contents. EX_RUNDOWN_REF sits in a small, predictable pool bucket, so reclaiming the slot before the acquire turns this into a corrupted-kernel-object primitive rather than a bugcheck.

Derived from the patch delta: the checks added by the vendor identify which fields crossed a trust boundary unvalidated. Reachability and privilege are taken from the call chain in the RCA report.

Known Exploits

Acknowledgments

Divya Sundar

On This Page