Microsoft dropped its June 2026 Patch Tuesday update, and among the fixes is CVE-2026-45636, a vulnerability that underscores why security classifications can be misleading. The flaw, rated “Important,” allows remote code execution (RCE) in the Windows NTFS file system. But the attack vector requires local access—specifically, mounting a malicious Virtual Hard Disk (VHD) file. The “remote” label has raised eyebrows, but it’s a reminder that even when exploitation demands a user’s action, the blast radius can be severe.

The vulnerability stems from a heap-based buffer overflow and improper input validation in NTFS’s handling of specially crafted VHD files. An attacker could craft a VHD that, when mounted by a logged-in user, triggers memory corruption, enabling arbitrary code execution with the privileges of that user. If the victim has administrator rights, the attacker gains full control of the system. Microsoft’s advisory notes that exploitation is “more likely” if successful, but no active attacks have been observed yet.

What Exactly Is CVE-2026-45636?

CVE-2026-45636 resides in the NTFS driver, ntfs.sys, which is the core file system driver for Windows NT-series operating systems. The bug allows a heap-based buffer overflow when processing a malformed VHD file. A heap buffer overflow occurs when data is written beyond the allocated buffer in the heap memory, potentially overwriting critical control structures. In this case, improper input validation fails to check the bounds of certain metadata fields in the VHD, leading to memory corruption.

The Common Vulnerability Scoring System (CVSS v3.1) score is 7.8 out of 10, placing it firmly in the “Important” severity category. The vector string is: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. This reads as: Attack Vector Local, Attack Complexity Low, Privileges Required None, User Interaction Required, Scope Unchanged, Confidentiality/Integrity/Availability impact High. The “Remote” designation in the CVE title comes from the “Remote Code Execution” impact category, not the attack vector. Microsoft classifies any code execution vulnerability as RCE if the attacker can execute code from outside the target process, even if the initial access is local.

Why “Remote” Is Misleading

The term “remote” in vulnerability summaries often confuses IT administrators. For CVE-2026-45636, the attack chain requires the victim to mount a malicious VHD file. This could be delivered via email attachment, downloaded from a compromised website, or introduced via a USB drive. So, while the initial delivery may be remote (e.g., phishing), the actual exploitation happens locally on the machine. This is typical for client-side attacks: a user double-clicks a file, and the system’s built-in handler—here, the Disk Management or Windows Explorer auto-mount feature—triggers the flaw.

Microsoft’s advisory states: “To exploit this vulnerability, an attacker would have to trick a user into mounting a specially crafted VHD file. The vulnerability itself is triggered when the VHD is mounted, which requires the user to be logged on.” No privilege escalation is needed to trigger the overflow, but the attacker gains the same rights as the logged-in user. That means if you’re running as a standard user, damage is limited, but if you’re an administrator, it’s game over.

The Mechanics: NTFS and VHD Processing

NTFS (New Technology File System) is a proprietary file system developed by Microsoft. It powers virtually all modern Windows installations. It supports features like file compression, encryption, disk quotas, and mounting of external files as disks. Virtual Hard Disk (VHD) files are disk image formats used by Microsoft’s Hyper-V, Virtual PC, and Virtual Server, but they’re also widely used for backup, disk management, and even Windows deployment. Windows natively supports mounting .vhd and .vhdx files as if they were physical drives.

When you mount a VHD, the operating system reads the file’s header and partition structures, then presents the disk as a local volume. This parsing process involves the NTFS driver interpreting various on-disk structures. CVE-2026-45636 arises because the driver doesn’t properly validate the length of certain metadata entries inside the VHD’s NTFS file system structures. By crafting an unusually large or malformed entry, an attacker can cause a buffer overflow in kernel memory, leading to control over the execution flow and eventual code execution in kernel context or a privileged user space.

The vulnerability was discovered internally by Microsoft, according to the advisory. No details about the researcher or disclosure timeline have been made public, but the fix was included in the June 2026 Patch Tuesday rollup.

How Severe Is the Threat?

While the CVSS score is 7.8, the “Important” rating might seem low for an RCE bug. The reason: the user interaction requirement significantly tempers the risk. For mass exploitation, attackers would need to conduct a convincing phishing campaign and hope that users mount the VHD—a less common action than opening a document or clicking a link. However, in targeted attacks, such as against enterprises or high-value individuals, VHD files can be disguised as legitimate disk images or system backups. PowerShell scripts or social engineering could automate the mounting step.

Organizations with strict AppLocker or WDAC policies that block unknown executables might still be vulnerable if VHD mounting is allowed. The attack bypasses code execution restrictions because it corrupts the existing, trusted ntfs.sys driver. Microsoft’s Defender for Endpoint and other EDR tools might detect anomalous VHD mounting activity, but the payload runs with system privileges, giving attackers a significant foothold.

Affected Systems

All supported Windows versions are affected. Microsoft’s advisory lists:
- Windows 10 version 22H2 (all editions)
- Windows 11 version 23H2 and 24H2
- Windows Server 2022 and 2025
- Windows 11 IoT Enterprise LTSC 2024
- Windows Server 2019 and 2016 (with specific update levels)

Embedded systems, including Windows IoT Core, may also be impacted but are less likely to have end users mounting VHDs. The fix is delivered via the standard Security Update Guide: for each version, a specific KB article and download link are provided. For instance, KB5039212 for Windows 11 24H2.

The Patch: What Microsoft Fixed

Microsoft’s June 2026 security update addresses the flaw by correcting the input validation in the NTFS driver. The patch ensures that buffer lengths are properly checked before data is copied. The advisory includes a workaround: potentially, disabling the mounting of VHD files via a registry tweak or Group Policy. Specifically, you can set the following key to block VHD mounts:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FltMgr]
"NoVhdMount"=dword:00000001

However, this might break legitimate virtual disk usage, so it’s not recommended for most environments. Patching is the primary mitigation.

The update is cumulative and includes other fixes; applying all June 2026 patches will resolve this issue. No reboot is specifically required for this CVE alone, but standard update processes will require a restart.

Historical Context: A String of NTFS Flaws

CVE-2026-45636 is not the first critical bug in NTFS’s handling of external files. In 2021, a vulnerability known as “Shrootless” (CVE-2021-41379) allowed elevation of privilege via Mount Point processing. In early 2022, a memory corruption bug in NTFS was exploited by just reading a malformed disk image. More recently, CVE-2025-24983 (disclosed March 2025) was an NTFS elevation-of-privilege vulnerability that also required mounting a VHD. The pattern suggests that the NTFS driver’s codebase, originally designed in a less security-conscious era, remains a rich target for researchers and attackers alike.

Each of these bugs relied on parsing untrusted file system metadata. The challenge is that NTFS must trust the structures it reads from mounted images; applying rigorous validation without breaking compatibility is a tightrope walk. Microsoft’s response has been a series of targeted fixes, but a comprehensive rewrite of the parsing logic remains elusive.

How to Protect Yourself

  1. Apply the June 2026 Patch Tuesday update immediately. This is the most effective step. For managed environments, use Windows Server Update Services (WSUS) or Microsoft Endpoint Configuration Manager. For home users, Windows Update will automatically offer the fix.
  2. Restrict VHD mounting in high-security environments. Use the registry workaround or AppLocker policies to block .vhd and .vhdx file execution, but test thoroughly to avoid disrupting virtual machine or backup workflows.
  3. Implement least privilege. Since the code runs with the mounted user’s rights, ensuring users don’t have administrative privileges reduces the impact. Standard user accounts can still be compromised, but the attacker would need a separate privilege escalation vulnerability to gain full control.
  4. Educate your users. Remind them not to open or mount disk images from unknown sources, especially if received via email or unexpected downloads. This is an uphill battle, but it helps.
  5. Monitor for VHD mounts. Security teams should look for suspicious vhdmp.sys or ntfs.sys events, such as unexpected mounting in %TEMP% or from Outlook attachments. Endpoint detection tools can flag these patterns.

Debunking Myths

Myth: The vulnerability requires administrative privileges to exploit.
Reality: No, it only requires that a user mount the VHD. The attacker gains the user’s privileges, so if the user is a standard user, the attacker is limited to that context.

Myth: The fix is not urgent because it’s “only” Important severity.
Reality: Important severity vulnerabilities are routinely exploited in targeted attacks. Given the ease of crafting a malicious VHD, this bug could be weaponized quickly. Patch now.

Myth: If I don’t use VHD files, I’m safe.
Reality: You might still be tricked into mounting one. An attacker could rename a .vhdx to a different extension and use social engineering to get you to double-click it; Windows may still recognize the format and mount it.

Looking Ahead: Will We See Exploitation?

Microsoft’s advisory notes that exploitation is “more likely” for this class of vulnerability. Proof-of-concept code is probably already being developed by white-hats and, unfortunately, threat actors. Since the bug is in the publicly documented NTFS on-disk structure, creating a malformed VHD is straightforward for anyone with reverse-engineering skills.

In the past, similar NTFS parsing bugs have been incorporated into sophisticated malware toolkits. The infamous Stuxnet exploited a shortcut parsing flaw. While mounting a VHD is a higher bar than clicking a link, advanced persistent threat (APT) groups often use multi-stage payloads where initial access leads to local attacks.

For IT defenders, the message is clear: this patch should not be delayed. The “remote” in the CVE title might lull some into a false sense of impossibility—don’t be fooled. If an attacker can get that VHD file onto your endpoint, they’re already inside the perimeter.

The Bottom Line

CVE-2026-45636 is a sobering reminder that file system drivers are prime targets. Microsoft’s quick fix is commendable, but the onus is on all of us to keep systems updated. The June 2026 Patch Tuesday addresses other high-severity bugs, too, so there’s even more reason to roll out the update. As always, balance thorough testing with the urgency of patching; in this case, the vulnerability’s local nature gives you a few days, but not weeks.

For home users: check Windows Update and restart your PC. For enterprises: prioritize this one—your domain controllers might not mount VHDs, but your users’ workstations certainly can. And for the curious: while we wait for public exploit code, take comfort that your favorite security researchers are already dissecting the patch to understand just how deep this heap overflow goes.