CVE-2026-70574: VHD Miniport Driver Privilege Escalation

CVE-2026-70574 Overview

CVE-2026-70574 is an out-of-bounds read vulnerability [CWE-125] in the Microsoft Windows Virtual Hard Disk (VHD) Miniport Driver. An authorized local attacker can exploit the flaw to elevate privileges on an affected system. The issue affects the kernel-mode driver responsible for handling VHD file operations, allowing a low-privileged user to read memory outside allocated buffer boundaries. Successful exploitation can lead to disclosure of sensitive kernel memory contents and enable privilege escalation to SYSTEM. Microsoft published the advisory through the Microsoft Security Response Center (MSRC) update guide.

Critical Impact
A local, authenticated attacker can leverage the out-of-bounds read to escalate privileges and gain full control of the affected Windows host.

Affected Products

Microsoft Windows (Virtual Hard Disk Miniport Driver component)
Refer to the Microsoft Security Update CVE-2026-70574 advisory for the full list of affected builds
Systems where the VHD Miniport Driver is loaded and accessible to standard users

Discovery Timeline

2026-09-08 - CVE-2026-70574 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-70574

Vulnerability Analysis

The vulnerability resides in the Windows Virtual Hard Disk (VHD) Miniport Driver, a kernel-mode component that handles I/O operations for VHD and VHDX disk image files. The driver performs an out-of-bounds read when processing attacker-influenced input, reading memory past the end of an allocated buffer. Because the read occurs in kernel context, the leaked data may include pointers, tokens, or other structures that assist an attacker in bypassing kernel address space layout randomization (KASLR) or crafting a follow-on write primitive.

Exploitation requires local access and low privileges. No user interaction is needed, and the attack executes entirely within the compromised user's session. When chained with additional primitives, the information disclosure enables a full elevation of privilege to SYSTEM, giving the attacker control over the operating system.

Root Cause

The root cause is missing or insufficient bounds validation on a buffer accessed by the VHD Miniport Driver during IOCTL or file operation handling. The driver dereferences memory using an offset or length value that is not properly constrained to the allocated buffer size, producing the out-of-bounds read condition described by [CWE-125].

Attack Vector

The attack vector is local. An authenticated user with the ability to open a handle to the VHD Miniport Driver device object issues a crafted request that triggers the vulnerable code path. See the Microsoft Security Update CVE-2026-70574 advisory for component-specific technical details.

// No verified proof-of-concept code is publicly available for CVE-2026-70574.
// Refer to the MSRC advisory for authoritative technical guidance.

Detection Methods for CVE-2026-70574

Indicators of Compromise

Unexpected process handle opens to the VHD Miniport Driver device object from non-administrative user contexts
Unusual mounting or attachment of VHD or VHDX files by standard users
Kernel-mode crashes or bug checks referencing the VHD Miniport Driver following user activity

Detection Strategies

Monitor Windows event logs and Sysmon for unexpected VHD or VHDX file access, mount, and attach operations initiated by non-privileged accounts
Establish baselines for legitimate VHD driver usage and alert on deviations, including unusual IOCTL patterns to the driver
Correlate local logon events with subsequent privilege escalation indicators such as new SYSTEM-context processes spawned from user sessions

Monitoring Recommendations

Enable kernel and driver auditing on endpoints where VHD functionality is not required for normal operations
Ingest endpoint telemetry into a centralized analytics platform to detect chained local privilege escalation behavior
Track patch compliance for the Windows security update that addresses CVE-2026-70574 across the fleet

How to Mitigate CVE-2026-70574

Immediate Actions Required

Apply the Microsoft security update referenced in the MSRC advisory for CVE-2026-70574 as soon as validated in your environment
Prioritize patching on multi-user systems, terminal servers, and virtual desktop infrastructure where local users are common
Audit local account provisioning and remove unnecessary interactive logon rights

Patch Information

Microsoft has released a security update addressing CVE-2026-70574 through the standard Windows Update channel. Consult the Microsoft Security Update CVE-2026-70574 advisory for the specific KB article, affected builds, and update package identifiers applicable to each supported Windows version.

Workarounds

Restrict interactive and remote local logon rights to trusted administrative accounts where operationally feasible
Where VHD or VHDX functionality is not required, restrict standard user access to the VHD driver interface through application control policies
Apply the principle of least privilege and enforce endpoint hardening baselines until patches are deployed

bash

# Verify installed Windows updates on an affected host (PowerShell)
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20