CVE-2026-81355: Remote Code Execution in Windows VHD Miniport Driver

What Happened

A flaw in the Windows Virtual Hard Disk (VHD) miniport driver permits remote code execution when a malicious VHD file is processed. The vulnerability, identified as CVE-2026-81355, can be triggered without user interaction by an attacker who can supply a crafted VHD to a vulnerable system.

Impact

Systems running Windows 10, Windows 11, Windows Server 2022, and earlier Windows Server releases that include the VHD miniport driver are affected. Successful exploitation grants the attacker full system privileges, enabling data exfiltration, persistence, or lateral movement.

Mitigation

• Apply the Microsoft security update released on 2026-09-20 (KBxxxxxx) for all affected Windows versions.
• Verify that the update is installed by checking the Windows Update history or running "wmic qfe list" for the relevant KB.
• Disable or restrict the use of VHD files on servers that do not require them; consider using Hyper-V or other virtualization technologies that do not rely on the legacy VHD driver.
• Implement application whitelisting to block execution of unknown VHD files.

Monitoring & Response

Watch for anomalous VHD file creation or access in event logs (Event ID 4663, 4664). Correlate with process creation events that show the VHD miniport driver (vhdmini.sys) being loaded. If suspicious activity is detected, isolate the host and run a full malware scan.

Microsoft has acknowledged the vulnerability and released a patch; the update is informational only.