CVE-2026-102220

high

EUVD alias: EUVD-2026-100370

Assigned by CNA: microsoft

Published 2026-10-13 · Modified 2026-10-13

Discuss on Community Propose mitigation

CVSS v3

7.8

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

CVSS v4 NEW

—

not yet in upstream

VIR risk

7.8

Description

Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.

Predictions

Exploit likelihood

75%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Microsoft Security Response Center · View original ↗ · proprietary-no-redistribution

Full prose not cached — VIR stores only structured fields (affected/fixed versions, references) for this source. Click "View original" above for the vendor's full advisory.

Affected

Vendor	Product	Version
microsoft	MessagePack 2.5.303
microsoft	Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 8.0 installed on Windows
microsoft	Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 8.0 installed on Linux
microsoft	Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 8.0 installed on Mac OS
microsoft	Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 9.0 installed on Linux
microsoft	Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 9.0 installed on Mac OS
microsoft	Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 9.0 installed on Windows
microsoft	Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 10.0 installed on Windows
microsoft	Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 10.0 installed on Mac OS
microsoft	Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 10.0 installed on Linux
microsoft	Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 11.0 installed on Windows
microsoft	Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 11.0 installed on Mac OS
microsoft	Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 11.0 installed on Linux
microsoft	Windows Server 2012
microsoft	Windows Server 2012 (Server Core installation)
microsoft	Windows Server 2012 R2
microsoft	Windows Server 2012 R2 (Server Core installation)
microsoft	Windows Server 2016
microsoft	Office Online Server
microsoft	Windows 10 Version 1607 for 32-bit Systems
microsoft	Windows 10 Version 1607 for x64-based Systems
microsoft	Windows Server 2016 (Server Core installation)
microsoft	Microsoft SharePoint Enterprise Server 2016
microsoft	Microsoft SQL Server 2017 for x64-based Systems (GDR)
microsoft	Windows 10 Version 1809 for 32-bit Systems
microsoft	Windows 10 Version 1809 for x64-based Systems
microsoft	Windows Server 2019
microsoft	Windows Server 2019 (Server Core installation)
microsoft	Microsoft SharePoint Server 2019
microsoft	Microsoft Dynamics NAV 2017 on Windows Server 2012

OS impact

Windows Affected 1 release

Version	Package	Status	Fixed in
—	—	Affected	—

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-102220

CWEs

CWE-416

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.