CVE-2026-102220

HighCVSS 7.8/10Last modified Oct 16, 2026

Description

Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 13, 2026
Last modified
Oct 16, 2026
NVD status
Undergoing Analysis

Related CVEs from 2026

CVE-2026-1022214.4No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.CVE-2026-1022258.8Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network.CVE-2026-1022268.8Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker toCVE-2026-1022277.8Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.CVE-2026-1022296.8Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an authorized attacker to discloCVE-2026-102236.3A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. This affects the function _scan_memory_content of the file toolCVE-2026-1022317.7Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2026-1022327.0Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2026-1022337.8Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.CVE-2026-1022347.4Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over CVE-2026-1022358.8Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.CVE-2026-1022389.6Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to exec
CVE-2026-102220: High severity, CVSS 7.8 | Vulnix