Microsoft has patched CVE-2026-58601, a high-impact elevation-of-privilege vulnerability in the Windows Virtual Hard Disk Miniport Driver, through the July 14, 2026 security updates. The flaw affects supported Windows 10, Windows 11, and Windows Server releases, and could let a locally authenticated attacker gain elevated control of a vulnerable system.
Detailed in Microsoft’s Security Update Guide and recorded by the National Vulnerability Database, CVE-2026-58601 is a heap-based buffer overflow classified as CWE-122. Microsoft assigned it a CVSS 3.1 base score of 7.8 and an Important severity rating, reflecting the serious consequences of successful exploitation without treating it as a remotely exploitable critical flaw.
Administrators should deploy the July cumulative updates rather than wait for additional technical disclosure. Microsoft’s assessment says the vulnerability was not publicly disclosed or known to be exploited when the updates were released.
CVE-2026-58601 exists in the Virtual Hard Disk Miniport Driver, a low-level Windows component associated with presenting and managing virtual disk storage. VHD and VHDX infrastructure is used by features and products including Hyper-V, native VHD mounting, boot-from-VHD deployments, development environments, backup tooling, and virtual machine management.
Microsoft describes the underlying defect as a heap-based buffer overflow. This class of memory-safety bug occurs when a component writes more data into a heap allocation than the allocation was designed to hold, potentially corrupting adjacent memory and influencing subsequent execution.
The published CVSS vector is
That distinction matters. CVE-2026-58601 is not presented as a vulnerability that an unauthenticated attacker can trigger directly across the network, but it could become a valuable second stage after phishing, credential theft, malicious document execution, or another intrusion technique establishes an ordinary user session.
Successful exploitation could produce high confidentiality, integrity, and availability impact. That scoring indicates the resulting elevated access may allow an attacker to read protected information, alter system resources, disable security controls, or otherwise take extensive control within the affected Windows security boundary.
Microsoft’s report-confidence metric is listed as confirmed. This means the vulnerability’s existence has been acknowledged with sufficient technical confidence, not merely inferred from an unexplained crash or an unverified third-party report.
Affected client platforms include:
For Windows 11 version 23H2, the July fix arrives in KB5099414, taking the operating system to build 22631.7376. Windows 11 versions 24H2 and 25H2 receive KB5101650, moving them to builds 26100.8875 and 26200.8875 respectively.
Windows 11 version 26H1 receives KB5101649 and advances to build 28000.2525. Microsoft says it is not currently aware of any known issues specific to that cumulative update, although enterprises should still complete their normal validation for storage, virtualization, backup, and endpoint security workloads.
On Windows Server 2022, the applicable July cumulative update is KB5099540, producing OS build 20348.5386. The CVE record identifies build 14393.9339 as the corrected threshold for Windows 10 version 1607 and Windows Server 2016, build 17763.9020 for Windows 10 version 1809 and Windows Server 2019, and build 26100.33158 for Windows Server 2025.
These build thresholds are particularly useful for vulnerability-management teams. Product names alone may not accurately reflect whether a machine has received the fix, especially where devices have delayed cumulative updates or are serviced through different enterprise rings.
CISA’s initial Stakeholder-Specific Vulnerability Categorization data likewise recorded no known exploitation and assessed the flaw as not readily automatable. It nevertheless assigned a total technical-impact outcome, consistent with Microsoft’s high confidentiality, integrity, and availability ratings.
That combination should guide prioritization rather than encourage delay. A local privilege-escalation bug typically does not create the first point of entry, but it can erase the containment benefit of running users and applications without administrator rights.
Attackers frequently chain an initial execution technique with a privilege-escalation vulnerability to move from a restricted context into SYSTEM-level control. Low attack complexity, low privileges required, and no user interaction make CVE-2026-58601 potentially useful in such a chain even though it cannot be launched directly against an exposed network service.
The affected component also sits below ordinary application boundaries. Driver flaws deserve particular attention because successful exploitation may provide access at a level where endpoint controls, credential protections, logging, and application restrictions become easier to undermine.
Public exploit code was not identified at release, and Microsoft has not published enough technical detail to establish the exact malformed input or driver interaction required. Administrators should not interpret that limited disclosure as proof that exploitation is impractical; it primarily reduces the immediate information available to would-be attackers.
Organizations should prioritize shared systems, administrative workstations, Hyper-V hosts, VHD-heavy development machines, and servers where a compromised standard account would expose sensitive workloads. Internet-facing status is less important for this specific CVE than the likelihood that an attacker could obtain local code execution through some other route.
Security teams can use the fixed-build thresholds for inventory and compliance checks, while administrators should verify deployment through Windows Update for Business, Windows Server Update Services, Microsoft Configuration Manager, or their normal patch-management platform. Scanning only for the CVE identifier without checking actual OS builds may produce incomplete results when update metadata has not yet propagated across security products.
The July packages contain other security and quality changes, so staged testing remains sensible. However, uninstalling or indefinitely deferring the cumulative update would restore exposure to CVE-2026-58601 along with the month’s other Windows vulnerabilities.
For most managed environments, the immediate milestone is straightforward: confirm that Windows 11 23H2 is at build 22631.7376, Windows 11 24H2 and 25H2 are at their KB5101650 builds, Windows 11 26H1 is at build 28000.2525, and supported Windows Server systems have received their corresponding July 14 update. Until those builds are present, an ordinary local foothold may still offer a route to substantially broader control.
Detailed in Microsoft’s Security Update Guide and recorded by the National Vulnerability Database, CVE-2026-58601 is a heap-based buffer overflow classified as CWE-122. Microsoft assigned it a CVSS 3.1 base score of 7.8 and an Important severity rating, reflecting the serious consequences of successful exploitation without treating it as a remotely exploitable critical flaw.
Administrators should deploy the July cumulative updates rather than wait for additional technical disclosure. Microsoft’s assessment says the vulnerability was not publicly disclosed or known to be exploited when the updates were released.
A Local Foothold Could Become Full System Control
CVE-2026-58601 exists in the Virtual Hard Disk Miniport Driver, a low-level Windows component associated with presenting and managing virtual disk storage. VHD and VHDX infrastructure is used by features and products including Hyper-V, native VHD mounting, boot-from-VHD deployments, development environments, backup tooling, and virtual machine management.Microsoft describes the underlying defect as a heap-based buffer overflow. This class of memory-safety bug occurs when a component writes more data into a heap allocation than the allocation was designed to hold, potentially corrupting adjacent memory and influencing subsequent execution.
The published CVSS vector is
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. In operational terms, an attacker must already have local access and low-level privileges, but exploitation is rated as low complexity and requires no action from another user.That distinction matters. CVE-2026-58601 is not presented as a vulnerability that an unauthenticated attacker can trigger directly across the network, but it could become a valuable second stage after phishing, credential theft, malicious document execution, or another intrusion technique establishes an ordinary user session.
Successful exploitation could produce high confidentiality, integrity, and availability impact. That scoring indicates the resulting elevated access may allow an attacker to read protected information, alter system resources, disable security controls, or otherwise take extensive control within the affected Windows security boundary.
Microsoft’s report-confidence metric is listed as confirmed. This means the vulnerability’s existence has been acknowledged with sufficient technical confidence, not merely inferred from an unexplained crash or an unverified third-party report.
The Patch Reaches Deep Into the Supported Windows Fleet
The affected-product record covers client and server editions spanning several generations. That breadth makes CVE-2026-58601 relevant even in environments where VHD functionality is not an obvious part of daily user activity.Affected client platforms include:
- Windows 10 versions 1607, 1809, 21H2, and 22H2 are affected on their applicable 32-bit, x64, and ARM64 platforms.
- Windows 11 version 23H2 is affected on x64 and ARM64 systems.
- Windows 11 versions 24H2 and 25H2 are affected on x64 and ARM64 systems.
- Windows 11 version 26H1 is affected on x64 and ARM64 systems.
For Windows 11 version 23H2, the July fix arrives in KB5099414, taking the operating system to build 22631.7376. Windows 11 versions 24H2 and 25H2 receive KB5101650, moving them to builds 26100.8875 and 26200.8875 respectively.
Windows 11 version 26H1 receives KB5101649 and advances to build 28000.2525. Microsoft says it is not currently aware of any known issues specific to that cumulative update, although enterprises should still complete their normal validation for storage, virtualization, backup, and endpoint security workloads.
On Windows Server 2022, the applicable July cumulative update is KB5099540, producing OS build 20348.5386. The CVE record identifies build 14393.9339 as the corrected threshold for Windows 10 version 1607 and Windows Server 2016, build 17763.9020 for Windows 10 version 1809 and Windows Server 2019, and build 26100.33158 for Windows Server 2025.
These build thresholds are particularly useful for vulnerability-management teams. Product names alone may not accurately reflect whether a machine has received the fix, especially where devices have delayed cumulative updates or are serviced through different enterprise rings.
Exploitation Is Not Reported, but the Path Is Attractive
Microsoft assessed exploitation as less likely at the time of publication. The vulnerability was not publicly disclosed before the coordinated release, and no active exploitation was reported in Microsoft’s initial advisory.CISA’s initial Stakeholder-Specific Vulnerability Categorization data likewise recorded no known exploitation and assessed the flaw as not readily automatable. It nevertheless assigned a total technical-impact outcome, consistent with Microsoft’s high confidentiality, integrity, and availability ratings.
That combination should guide prioritization rather than encourage delay. A local privilege-escalation bug typically does not create the first point of entry, but it can erase the containment benefit of running users and applications without administrator rights.
Attackers frequently chain an initial execution technique with a privilege-escalation vulnerability to move from a restricted context into SYSTEM-level control. Low attack complexity, low privileges required, and no user interaction make CVE-2026-58601 potentially useful in such a chain even though it cannot be launched directly against an exposed network service.
The affected component also sits below ordinary application boundaries. Driver flaws deserve particular attention because successful exploitation may provide access at a level where endpoint controls, credential protections, logging, and application restrictions become easier to undermine.
Public exploit code was not identified at release, and Microsoft has not published enough technical detail to establish the exact malformed input or driver interaction required. Administrators should not interpret that limited disclosure as proof that exploitation is impractical; it primarily reduces the immediate information available to would-be attackers.
Update Compliance Is the Useful Mitigation
Microsoft has supplied an official fix, and the advisory does not identify a configuration-based workaround that offers equivalent protection. The practical response is therefore to install the appropriate July 2026 cumulative update and confirm that each device reached the corrected build.Organizations should prioritize shared systems, administrative workstations, Hyper-V hosts, VHD-heavy development machines, and servers where a compromised standard account would expose sensitive workloads. Internet-facing status is less important for this specific CVE than the likelihood that an attacker could obtain local code execution through some other route.
Security teams can use the fixed-build thresholds for inventory and compliance checks, while administrators should verify deployment through Windows Update for Business, Windows Server Update Services, Microsoft Configuration Manager, or their normal patch-management platform. Scanning only for the CVE identifier without checking actual OS builds may produce incomplete results when update metadata has not yet propagated across security products.
The July packages contain other security and quality changes, so staged testing remains sensible. However, uninstalling or indefinitely deferring the cumulative update would restore exposure to CVE-2026-58601 along with the month’s other Windows vulnerabilities.
For most managed environments, the immediate milestone is straightforward: confirm that Windows 11 23H2 is at build 22631.7376, Windows 11 24H2 and 25H2 are at their KB5101650 builds, Windows 11 26H1 is at build 28000.2525, and supported Windows Server systems have received their corresponding July 14 update. Until those builds are present, an ordinary local foothold may still offer a route to substantially broader control.
References
- Primary source: MSRC
Published: 2026-07-14T07:00:00-07:00
Security Update Guide - Microsoft Security Response Center
msrc.microsoft.com
