CVE-2026-59125

Published August 11, 2026 · Source: nvd

Analysis

## Summary
CVE-2026-59125 describes a use-after-free vulnerability in the Virtual Hard Disk (VHD) miniport driver. An authorized local attacker can leverage the flaw to elevate privileges.

## Technical Details
- Vulnerability type: Use after free (CWE-416)
- Affected component: Virtual Hard Disk (VHD) miniport driver
- Consequence: memory safety issue that can be exploited to alter control flow and gain higher privileges
- Preconditions: attacker must be authorized (per NVD: PR:L / AC:H)

## Affected
- Product scope: not provided in the available material (no reference content fetched)

## Impact
- Privilege escalation: local attacker can elevate privileges
- CIA impact (from CVSS vector):
- Confidentiality: C:H
- Integrity: I:H
- Availability: A:H

## Mitigation
1. Apply vendor patches or updates for the VHD miniport driver once available.
2. Reduce exposure by limiting local authorized access to systems where the VHD miniport driver is present.
3. Monitor for suspicious local activity consistent with privilege escalation attempts (exact indicators not provided in the available material).

CVSS Vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness

CWE-416

Affected Products

• microsoft — windows 10 1607 (< 10.0.14393.9418)
• microsoft — windows 10 1809 (< 10.0.17763.9115)
• microsoft — windows 10 21h2 (< 10.0.19044.7663)
• microsoft — windows 10 22h2 (< 10.0.19045.7663)
• microsoft — windows 11 23h2 (< 10.0.22631.7517)
• microsoft — windows 11 24h2 (< 10.0.26100.9106)
• microsoft — windows 11 25h2 (< 10.0.26200.9106)
• microsoft — windows 11 26h1 (< 10.0.28000.2704)
• microsoft — windows server 2016 (< 10.0.14393.9418)
• microsoft — windows server 2019 (< 10.0.17763.9115)
• microsoft — windows server 2022 (< 10.0.20348.5440)
• microsoft — windows server 2025 (< 10.0.26100.33222)

References

• [email protected]

← Browse all CVEs