The issue is a use-after-free weakness in the Windows VHD miniport driver. In plain English: a component handling virtual hard-disk operations can improperly use memory after it has been released. Microsoft states that an authorized attacker could exploit the flaw locally to elevate privileges, potentially reaching the operating system’s most powerful security context.
Windows VHD miniport driver Elevation of Privilege Vulnerability: Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.
Microsoft further states: “An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.”
That makes this a patching priority for administrators, particularly where local access is already plausible—through a compromised standard user account, remote desktop access, or software running under limited credentials. Elevation-of-privilege bugs do not typically provide the initial foothold, but they can turn a small intrusion into a full-machine takeover. In security terms, they are the ladder waiting behind the unlocked window.
Vulnerability details
| Item | Detail |
|---|---|
| CVE | CVE-2026-56172 |
| Title | Windows VHD miniport driver Elevation of Privilege Vulnerability |
| Severity | Important |
| CVSS base score | 7.8 |
| CVSS temporal score | 6.8 |
| CVSS vector | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C |
| CWE | CWE-416 |
| Weakness type | Use after free |
| Impact | Elevation of privilege to SYSTEM |
| Exploitation assessment | Exploitation Less Likely |
| Publicly disclosed: No | |
| Exploited: No | |
| Customer action required: Yes |
The CVSS vector describes a local attack with low complexity and low privileges required, without user interaction. Successful exploitation could affect confidentiality, integrity, and availability at a high level. That scope is consistent with Microsoft’s warning that an attacker could obtain SYSTEM privileges.
Systems covered by the update
The affected list spans legacy Windows 10 deployments, supported Windows 11 releases, and multiple Windows Server generations. ARM64 is included for several client versions, so this is not merely an x64 data-center concern.
Windows 10 remediation
- Windows 10 Version 1809 for 32-bit Systems (x86): For Windows 10 Version 1809 for 32-bit Systems (x86), install KB5122876 to reach fixed build 10.0.17763.9245.
- Windows 10 Version 1809 for x64-based Systems: For Windows 10 Version 1809 for x64-based Systems, install KB5122876 to reach fixed build 10.0.17763.9245.
- Windows 10 Version 21H2 for 32-bit Systems (x86): For Windows 10 Version 21H2 for 32-bit Systems (x86), install KB5122878 to reach fixed build 10.0.19044.7725.
- Windows 10 Version 21H2 for ARM64-based Systems: For Windows 10 Version 21H2 for ARM64-based Systems, install KB5122878 to reach fixed build 10.0.19044.7725.
- Windows 10 Version 21H2 for x64-based Systems: For Windows 10 Version 21H2 for x64-based Systems, install KB5122878 to reach fixed build 10.0.19044.7725.
- Windows 10 Version 22H2 for 32-bit Systems (x86): For Windows 10 Version 22H2 for 32-bit Systems (x86), install KB5122878 to reach fixed build 10.0.19045.7725.
- Windows 10 Version 22H2 for ARM64-based Systems: For Windows 10 Version 22H2 for ARM64-based Systems, install KB5122878 to reach fixed build 10.0.19045.7725.
- Windows 10 Version 22H2 for x64-based Systems: For Windows 10 Version 22H2 for x64-based Systems, install KB5122878 to reach fixed build 10.0.19045.7725.
Windows 11 remediation
- Windows 11 Version 23H2 for ARM64-based Systems: For Windows 11 Version 23H2 for ARM64-based Systems, install KB5122880 to reach fixed build 10.0.22631.7582.
- Windows 11 Version 23H2 for x64-based Systems: For Windows 11 Version 23H2 for x64-based Systems, install KB5122880 to reach fixed build 10.0.22631.7582.
- Windows 11 Version 24H2 for ARM64-based Systems: For Windows 11 Version 24H2 for ARM64-based Systems, install KB5124008 to reach fixed build 10.0.26100.9445.
- Windows 11 Version 24H2 for x64-based Systems: For Windows 11 Version 24H2 for x64-based Systems, install KB5124008 to reach fixed build 10.0.26100.9445.
- Windows 11 Version 25H2 for ARM64-based Systems: For Windows 11 Version 25H2 for ARM64-based Systems, install KB5124008 to reach fixed build 10.0.26200.9445.
- Windows 11 Version 25H2 for x64-based Systems: For Windows 11 Version 25H2 for x64-based Systems, install KB5124008 to reach fixed build 10.0.26200.9445.
- Windows 11 Version 26H1 for ARM64-based Systems: For Windows 11 Version 26H1 for ARM64-based Systems, install KB5124012 to reach fixed build 10.0.28000.2954.
- Windows 11 version 26H1 for x64-based Systems: For Windows 11 version 26H1 for x64-based Systems, install KB5124012 to reach fixed build 10.0.28000.2954.
Windows Server remediation
- Windows Server 2019 (Server Core installation) (x64): For Windows Server 2019 (Server Core installation) (x64), install KB5122876 to reach fixed build 10.0.17763.9245.
- Windows Server 2019 (x64): For Windows Server 2019 (x64), install KB5122876 to reach fixed build 10.0.17763.9245.
- Windows Server 2022 (Server Core installation) (x64): For Windows Server 2022 (Server Core installation) (x64), install KB5122882 to reach fixed build 10.0.20348.5622.
- Windows Server 2022 (x64): For Windows Server 2022 (x64), install KB5122882 to reach fixed build 10.0.20348.5622.
- Windows Server 2025 (Server Core installation) (x64): For Windows Server 2025 (Server Core installation) (x64), install KB5122871 to reach fixed build 10.0.26100.33438.
- Windows Server 2025 (x64): For Windows Server 2025 (x64), install KB5122871 to reach fixed build 10.0.26100.33438.
What IT administrators should do
Apply the applicable cumulative update through the organization’s standard Windows servicing process, then verify that systems have reached the corresponding fixed build. Enterprises using Windows Update for Business, Windows Server Update Services, Microsoft Configuration Manager, Intune, or another endpoint-management platform should confirm successful installation across both client and server inventories.
Prioritize machines where standard users can sign in interactively, where virtualization-related workloads are used, or where a local compromise could lead to wider domain or tenant consequences. Server Core installations are included in the affected products, so a reduced graphical footprint is not a substitute for patching.
For users of managed PCs, the immediate task is pleasantly unglamorous: install the offered Windows update and restart when prompted. Security maintenance rarely gets a standing ovation, but preventing a local attacker from turning a low-privilege account into SYSTEM is exactly the sort of backstage work that keeps the show running.
References
- Official MSRC or vendor evidence api.msrc.microsoft.com
- Official MSRC or vendor evidence msrc.microsoft.com
- Official MSRC or vendor evidence api.msrc.microsoft.com