CVE-2025-54112 Overview
CVE-2025-54112 is a use-after-free vulnerability [CWE-416] in the Microsoft Virtual Hard Drive (VHD) component. An authorized local attacker can trigger the freed memory condition to elevate privileges on affected Windows systems. Successful exploitation grants the attacker access to resources beyond their original permission level, including SYSTEM-level code execution in typical scenarios.
The flaw affects a broad range of Windows client and server releases, from Windows 10 1507 through Windows 11 24H2, and Windows Server 2016 through Windows Server 2025. Microsoft published the advisory on September 9, 2025.
Critical Impact
A local authorized user can exploit a use-after-free condition in the Virtual Hard Drive driver to elevate privileges and gain full control of the affected Windows host.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (22H2, 23H2, 24H2)
- Microsoft Windows Server 2016, 2019, 2022, 2022 23H2, and 2025
Discovery Timeline
- 2025-09-09 - CVE-2025-54112 published to NVD and Microsoft advisory released
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-54112
Vulnerability Analysis
The vulnerability resides in the Microsoft Virtual Hard Drive subsystem, which provides VHD and VHDX file support for mounting, attaching, and managing virtual disk images on Windows. The flaw is a use-after-free condition, meaning code paths reference a memory object after it has been released back to the allocator.
When the attacker manipulates the object lifecycle through crafted VHD operations, the kernel or a privileged driver dereferences the stale pointer. This dereference can be turned into a controlled write or code execution primitive by pre-allocating attacker-controlled data in the reclaimed memory region. The result is privilege escalation on the local system.
Exploitation requires the attacker to already hold valid credentials on the target host and successfully win a race or timing condition to trigger the freed reference.
Root Cause
The root cause is improper object lifetime management within the Virtual Hard Drive driver. A reference to a heap object is retained and used after the object has been freed, allowing subsequent operations to act on memory that may have been reallocated for a different purpose. This class of defect is tracked under CWE-416: Use After Free.
Attack Vector
The attack vector is local. An authenticated user issues a specific sequence of Virtual Hard Drive operations, such as attach, detach, or mount requests against a crafted VHD or VHDX image, to induce the free while another reference remains active. The follow-on operation dereferences the stale pointer and yields kernel-mode primitives suitable for privilege escalation.
No verified public proof-of-concept is available at the time of this writing. Technical exploitation details are documented in the Microsoft Security Response Center advisory.
Detection Methods for CVE-2025-54112
Indicators of Compromise
- Unexpected process creations spawned as NT AUTHORITY\SYSTEM from a session that started under a standard user account.
- Anomalous VHD or VHDX mount, attach, or detach operations issued by non-administrative users through diskpart, PowerShell Mount-VHD, or direct calls to virtdisk.dll.
- Kernel bugchecks or crashes referencing the Virtual Hard Drive driver stack in Windows Error Reporting.
Detection Strategies
- Monitor for local privilege transitions where a standard-user process is followed by execution of a child process at higher integrity levels.
- Alert on repeated or high-frequency VHD attach/detach cycles from a single non-admin user, which can indicate race-condition exploitation attempts.
- Correlate driver crash events (Event ID 41, 1001) with prior VHD activity from the same user session.
Monitoring Recommendations
- Enable Windows kernel auditing and forward Sysmon Event IDs 1 (process creation) and 10 (process access) to a centralized SIEM.
- Track access to \\.\PhysicalDrive* and VHD-related device objects by non-administrative principals.
- Baseline normal VHD mount activity in your environment and flag deviations, particularly on servers and developer workstations.
How to Mitigate CVE-2025-54112
Immediate Actions Required
- Apply the Microsoft September 2025 security updates to all affected Windows client and Windows Server systems.
- Prioritize patching on multi-user hosts, terminal servers, and virtualization hosts where local users are more numerous.
- Audit local account membership and remove unnecessary interactive logon rights for standard users.
Patch Information
Microsoft released fixes on September 9, 2025 through the monthly cumulative updates. Refer to the Microsoft Security Update Guide for CVE-2025-54112 for the specific KB numbers that correspond to each affected Windows build and install them through Windows Update, WSUS, or your preferred patch management pipeline.
Workarounds
- Restrict the ability of standard users to mount or attach VHD and VHDX files where operationally feasible, using AppLocker or Windows Defender Application Control policies.
- Limit interactive logon on sensitive systems to administrative and service accounts only until patches are deployed.
- Enforce least-privilege on developer and virtualization workstations by revoking the SeManageVolumePrivilege from non-administrative users where possible.
# Example: query patch status for CVE-2025-54112 via PowerShell
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
# Verify the Virtual Disk service configuration
Get-Service -Name vds | Format-List Name, Status, StartType
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
