CVE-2026-81355 is a high severity (CVSS 7.5) heap based buffer overflow in the Windows Virtual Hard Disk (VHD) Miniport Driver. An authorized local attacker could execute code. Microsoft addresses it through its security update; check the Security Update Guide for the package that matches your Windows build.
What's affected
- Windows 10 versions 1607, 1809, 21H2 and 22H2, as listed in the record.
- Windows 11 versions 23H2, 24H2, 25H2 and 26H1, also per the record.
- Fixed by the Microsoft security update for your build. We could not read the Microsoft Security Update Guide page, because it needs JavaScript, so the product list and wording come from the CVE record. Open the Microsoft page for the exact update package for your build.
Record severity: CVSS 7.5 (high), vector CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. The weakness class is CWE-122, Heap-based Buffer Overflow.
How to check if you're exposed
Run winver to read the Windows build and compare it with the update named in the Microsoft guide. Get-HotFix in PowerShell lists installed updates. Your endpoint manager can report the same across many machines.
What to do now
- Read the Microsoft guide entry and note the update for each Windows build.
- Deploy the update through your normal patch process.
- Prioritize shared hosts such as terminal servers and build machines, where several people have local accounts.
- Review local administrator membership.
- Verify installed updates after reboot.
Why it matters
A heap based buffer overflow (CWE-122) writes past the end of an allocated memory block. In a kernel mode storage driver this can corrupt kernel memory, which is why local code execution here carries a changed scope in the CVSS vector.
The attacker needs local access and high privileges, and the complexity is high, so the practical risk is lower than the score suggests on well managed single user machines. On multi user servers the story differs. The record does not mark this CVE as known exploited.
Quick check
Can it be exploited remotely?
The record says the attacker executes code locally.
How do I get the fix?
Install the Microsoft security update for your Windows build.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
