CVE-2026-58601: Windows 10 1607 Privilege Escalation Flaw

CVE-2026-58601 Overview

CVE-2026-58601 is a heap-based buffer overflow vulnerability in the Microsoft Virtual Hard Disk (VHD) Miniport Driver. The flaw allows an authenticated local attacker to elevate privileges on affected Windows systems. The vulnerability is tracked under CWE-122, Heap-based Buffer Overflow. Successful exploitation grants the attacker the ability to execute code in the context of the kernel driver, resulting in full compromise of confidentiality, integrity, and availability on the affected host. The vulnerability affects a broad range of Windows client and server versions, from Windows 10 1607 through Windows 11 26H1, and from Windows Server 2016 through Windows Server 2025.

Critical Impact
A local, authenticated attacker can trigger a heap overflow in the VHD Miniport Driver to escalate to SYSTEM-level privileges on Windows and Windows Server systems.

Affected Products

Microsoft Windows 10 (versions 1607, 1809, 21H2, 22H2) on x86, x64, and ARM64
Microsoft Windows 11 (versions 23H2, 24H2, 25H2, 26H1) on x64 and ARM64
Microsoft Windows Server 2016, 2019, 2022, and 2025

Discovery Timeline

2026-07-14 - CVE-2026-58601 published to the National Vulnerability Database
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-58601

Vulnerability Analysis

The vulnerability resides in the Virtual Hard Disk (VHD) Miniport Driver, a kernel-mode component responsible for handling VHD and VHDX virtual disk images on Windows. A heap-based buffer overflow occurs when the driver processes untrusted input associated with virtual disk operations. Because the driver runs in kernel context, memory corruption at the heap boundary can be leveraged to overwrite adjacent kernel objects. An authorized local user can invoke the driver through IOCTL requests or by mounting a crafted VHD/VHDX image to trigger the overflow. Successful exploitation yields SYSTEM privileges, enabling arbitrary code execution in kernel mode.

Root Cause

The root cause is improper validation of buffer sizes during heap allocation and copy operations within the VHD Miniport Driver (CWE-122). Attacker-supplied length fields or structure sizes are used without sufficient sanity checking, causing the driver to write beyond the bounds of a kernel heap allocation.

Attack Vector

Exploitation requires local access with low-privilege authentication. No user interaction is needed, and the attack complexity is low. An attacker with a standard account can interact with the VHD driver interface, mount a malicious virtual disk image, or issue crafted IOCTL requests to trigger the overflow. Because kernel drivers run with the highest privilege on the system, kernel-mode code execution translates directly into full host compromise.

No public proof-of-concept exploit was available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-58601

Indicators of Compromise

Unexpected mounting of .vhd or .vhdx files from user-writable directories or temporary paths
Kernel bugchecks or system crashes referencing the vhdmp.sys driver or related VHD miniport components
Creation of new SYSTEM-level processes spawned from non-administrative user sessions shortly after VHD driver activity

Detection Strategies

Monitor kernel event logs and Windows Error Reporting (WER) for driver faults involving the VHD miniport driver.
Audit process creation events (Event ID 4688) for privilege transitions where a low-privilege user context spawns SYSTEM processes.
Track DeviceIoControl calls to the VHD driver device object from unusual or unsigned binaries.

Monitoring Recommendations

Enable Windows Defender Application Control or driver block rules to restrict which processes can interact with virtual disk subsystems.
Collect and forward Sysmon events (IDs 1, 6, and 13) to a centralized logging platform for correlation of driver load and file mount activity.
Baseline normal VHD/VHDX usage in the environment and alert on mounts originating from non-administrative user contexts.

How to Mitigate CVE-2026-58601

Immediate Actions Required

Apply the Microsoft security update for CVE-2026-58601 to all affected Windows 10, Windows 11, and Windows Server systems as documented in the Microsoft Security Update Guide.
Inventory endpoints and servers running the affected Windows builds and prioritize patching for multi-user systems, terminal servers, and virtualization hosts.
Restrict local logon rights and limit the number of accounts with interactive access on sensitive systems.

Patch Information

Microsoft has released security updates addressing this vulnerability. Refer to the Microsoft Security Update Guide entry for CVE-2026-58601 for the specific KB articles and cumulative updates applicable to each supported Windows version. Apply patches through Windows Update, WSUS, Microsoft Intune, or Configuration Manager as appropriate for the environment.

Workarounds

Where patching cannot be applied immediately, restrict the ability of standard users to mount VHD or VHDX files by enforcing least-privilege policies and Group Policy restrictions.
Disable or block the loading of untrusted virtual disk images from user-controlled locations via AppLocker or Windows Defender Application Control rules.
Monitor and constrain access to the VHD Miniport Driver device interfaces on high-value hosts pending deployment of the vendor patch.

bash

# Example: Query patch status for the VHD miniport driver on Windows
Get-WmiObject -Class Win32_QuickFixEngineering | Sort-Object -Property InstalledOn -Descending
Get-WindowsDriver -Online -All | Where-Object { $_.Driver -like '*vhdmp*' }