CVE-2026-56172 Overview
CVE-2026-56172 is a use-after-free vulnerability [CWE-416] in the Windows Virtual Hard Disk (VHD) miniport driver. An authorized local attacker can exploit the flaw to elevate privileges on an affected Windows host. Microsoft published the advisory on September 8, 2026.
The vulnerability requires local access and low privileges but no user interaction. Successful exploitation compromises confidentiality, integrity, and availability. Attackers typically chain local privilege escalation flaws like this with initial-access techniques to obtain SYSTEM-level code execution on Windows endpoints.
Critical Impact
Local attackers with standard user privileges can elevate to SYSTEM by triggering a use-after-free condition in the Windows VHD miniport driver, enabling full host compromise.
Affected Products
- Microsoft Windows (VHD miniport driver component)
- Refer to the Microsoft Vulnerability Advisory CVE-2026-56172 for the full list of affected Windows versions and build numbers
Discovery Timeline
- 2026-09-08 - CVE-2026-56172 published to the National Vulnerability Database
- 2026-09-08 - Microsoft published the Microsoft Vulnerability Advisory CVE-2026-56172
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-56172
Vulnerability Analysis
The Windows VHD miniport driver mediates access to virtual hard disk devices, including .vhd and .vhdx files that Windows exposes as SCSI or storage volumes. A use-after-free condition [CWE-416] exists in this driver, meaning kernel code references a memory object after it has been freed.
When an attacker triggers the flawed code path, the driver operates on a dangling pointer. If the attacker sprays or reallocates the freed kernel pool with attacker-controlled data, the driver's subsequent operations dereference that data as though it were a legitimate object. This enables arbitrary kernel read, write, or control-flow hijack primitives.
Because the VHD miniport driver runs in kernel mode, successful exploitation yields SYSTEM-level execution. This bypasses application sandboxes, User Account Control (UAC), and standard user boundaries on the host.
Root Cause
The root cause is improper lifetime management of a kernel object handled by the VHD miniport driver. The driver frees an object while another code path retains a reference to it, and later dereferences that stale pointer. Microsoft has not published implementation-level details of the affected function.
Attack Vector
Exploitation requires local access with at least standard user privileges. An attacker mounts or interacts with a crafted virtual disk, or invokes IOCTLs against the VHD miniport driver, to reach the vulnerable code path. Remote or unauthenticated exploitation is not possible. See the Microsoft advisory for exploitation index metadata.
Detection Methods for CVE-2026-56172
Indicators of Compromise
- Unexpected kernel-mode crashes or bugchecks referencing the VHD miniport driver in Minidump files or Windows Error Reporting
- Non-administrative processes performing AttachVirtualDisk, CreateVirtualDisk, or IOCTLs against \\.\VhdmpControl and related device objects
- Sudden creation of SYSTEM-owned processes parented to standard user sessions
- Presence of .vhd or .vhdx files in user-writable directories such as %TEMP% or %APPDATA% immediately preceding privilege changes
Detection Strategies
- Monitor Sysmon Event ID 1 (process create) for non-admin processes invoking diskpart, PowerShell Mount-VHD, or custom binaries that open handles to VHD device objects
- Correlate kernel crash telemetry with process ancestry to identify local users triggering driver faults
- Alert on Windows Event Log entries indicating driver load or crash events referencing vhdmp.sys or related storage miniport binaries
Monitoring Recommendations
- Ingest endpoint telemetry into a centralized data lake and query for anomalous VHD mount operations by non-privileged users
- Baseline expected VHD usage per host role; investigate deviations on workstations that do not normally use virtual disks
- Track privilege transitions from medium to high integrity that follow storage driver activity within a short time window
How to Mitigate CVE-2026-56172
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Vulnerability Advisory CVE-2026-56172 across all affected Windows hosts
- Prioritize patching for multi-user systems, jump hosts, and virtual desktop infrastructure where local users are present
- Audit endpoints for standard users with unexpected access to VHD mount operations
Patch Information
Microsoft has released a security update addressing the use-after-free condition in the VHD miniport driver. Consult the Microsoft Vulnerability Advisory CVE-2026-56172 for the specific KB article, affected builds, and update packages applicable to each Windows version in your environment.
Workarounds
- No official workaround has been published; patching is the required remediation
- Restrict the ability of standard users to mount arbitrary VHD or VHDX files through Group Policy and file system permissions where feasible
- Apply application control policies to block execution of untrusted binaries that interact with storage driver interfaces
# Verify installed update on Windows hosts (PowerShell)
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
# List loaded drivers to confirm vhdmp.sys version after patching
driverquery /v /fo csv | findstr /I "vhdmp"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.