CVE-2026-59125

This bug is in a Windows driver that helps the system work with “virtual hard disks.” If a person already able to log in with low privileges finds the right way to trigger the bug, they can jump to full system control—like getting the keys to the building, then bypassing security doors.
Because it’s local and requires authentication, it’s not usually something outsiders can do directly from the internet.

This matters if you use or manage Windows 10, Windows 11, or Windows Server 2016/2019/2022/2025 devices, because the vulnerable Virtual Hard Disk (VHD) miniport driver is part of Windows.
It primarily becomes a concern when an attacker already has low-privilege local access (since authentication is required) and can attempt the triggering conditions on that machine. Reachability in the default configuration is not yet known from the provided findings, so the safe rule is: treat any device with local logon exposure as in-scope.

Verdict: RED. This is a privilege-escalation bug that can execute arbitrary code with elevated privileges once a local low-privilege attacker can trigger it.
Even though there’s no confirmed dated public exploit report for this exact CVE in the provided findings, it has patch-focused press attention and is tied to a known actor in the provided pulse data, so you should treat it as an urgent patching priority.

1. Inventory and confirm versions

   • For each affected device, record the Windows edition (Windows 10/11 or Windows Server 2016/2019/2022/2025) and the current OS build.

2. Determine whether the device is vulnerable

   • A device is considered affected if its build is earlier than the fixed build listed for its branch below.
   • Use the device build number you recorded and compare it to the fixed versions section.

3. Patch to the correct fixed version (by branch)

   • Windows 10 fixed in:
     • 10.0.14393.9418
     • 10.0.17763.9121
     • 10.0.19044.7663
     • 10.0.19045.7663
   • Windows 11 fixed in:
     • 10.0.22631.7517
     • 10.0.26100.9168
     • 10.0.26200.9168
     • 10.0.28000.2704
   • Windows Server fixed in:
     • Windows Server 2016: 10.0.14393.9418
     • Windows Server 2019: 10.0.17763.9121
     • Windows Server 2022: 10.0.20348.5499
     • Windows Server 2025: 10.0.26100.33296

4. Verify the fix

   • After patching, confirm the OS build number matches the fixed build for that branch.
   • Confirm Windows Update reports the device as up to date.

5. Temporary mitigation if you cannot patch immediately

   • Reduce local login exposure: remove unnecessary local accounts and restrict who can log on locally.
   • Minimize the chance an attacker already inside your environment can run code locally by tightening local permissions.

6. What to monitor after patching

   • Look for unusual system behavior around driver/service stability and VHD-related activity.
   • Review security logs for unexpected privilege changes or suspicious process execution patterns from local users.

Notes on exploitation status and deadlines

• The provided findings do not list this issue in CISA KEV, and there is no dated press claim of active exploitation for this exact CVE.
• Because the overall verdict is RED and exploitation is possible under the described local conditions, prioritize fixing immediately using the exact fixed builds above.

CVE-2026-59125 is a local privilege escalation via a use-after-free (CWE-416) vulnerability in the Virtual Hard Disk (VHD) miniport driver. The mechanism described in the findings is that an authenticated local attacker with low privileges can trigger the bug and gain elevated execution leading to full compromise.

Severity and likelihood

• Marked HIGH by the provided CVSS scoring.
• Predicted likelihood (EPSS) is provided as 0.2% with a flat trend, but this is a prediction and is not treated as proof of active exploitation.

Exploitation status

• No public exploit code was found in the provided findings.
• No CISA KEV listing was provided.
• The press findings do not attribute specific active exploitation to this exact CVE, but the PULSE section indicates patch-focused attention and an associated actor (Lazarus group) in the provided context.

Attack vector and requirements

• Local attack with authentication required, no user interaction required. Exploitation depends on local access and specific triggering conditions (noted as higher complexity in the provided findings), consistent with use-after-free timing/race or memory-layout sensitivity.