CVE-2016-7226

MEDIUM

Windows 10 and Windows Server 2016 - Privilege Escalation via VHD Driver

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-7226. PoCs published by Google Security Research.

AI-analyzed exploit summary The provided C# code demonstrates an elevation of privilege (EoP) vulnerability in the Windows VHDMP driver (CVE-2016-7226) by exploiting arbitrary file creation/overwrite via Resilient Change Tracking (RCT) functionality. The PoC creates files in restricted directories (e.g., \Windows) by leveraging improper access checks in ZwCreateFile.

Description

Virtual Hard Disk Driver in Windows 10 Gold, 1511, and 1607 and Windows Server 2016 does not properly restrict access to files, which allows local users to gain privileges via a crafted application, aka "VHD Driver Elevation of Privilege Vulnerability."

Exploits (1)

exploitdb WORKING POC VERIFIED
by Google Security Research · localwindows
https://www.exploit-db.com/exploits/40763

The provided C# code demonstrates an elevation of privilege (EoP) vulnerability in the Windows VHDMP driver (CVE-2016-7226) by exploiting arbitrary file creation/overwrite via Resilient Change Tracking (RCT) functionality. The PoC creates files in restricted directories (e.g., \Windows) by leveraging improper access checks in ZwCreateFile.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: Windows 10 (10586 and 14393)
No auth needed
Prerequisites: User-level access to the system · Ability to compile and execute C# code
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (4)

Core 4
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1037248
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/94018
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/40763/

Scores

CVSS v3 6.1
EPSS 0.0411
EPSS Percentile 89.4%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Details

CWE
CWE-284
Status published
Products (4)
microsoft/windows_10
microsoft/windows_10 1511
microsoft/windows_10 1607
microsoft/windows_server_2016
Published Nov 10, 2016
Tracked Since Feb 18, 2026