Skip to content
Microsoft Blocks Macrium Reflect Driver in Windows 11 Updates

Microsoft Blocks Macrium Reflect Driver in Windows 11 Updates

First seen 2 May 2026, 16:36 UTC

Article Content

Browse articles
ThreatCluster AI
ThreatCluster May 3, 2026 at 16:18 UTC
  • Microsoft's updates block the Macrium Reflect driver due to a known vulnerability.
  • Affected users cannot mount disk images, limiting backup functionality.
  • A temporary Registry hack workaround exists but increases security risks.

On May 2, 2026, Microsoft confirmed that its recent Windows 11 updates (KB5083769 and KB5083631) block the Macrium Reflect driver, psmounterex.sys, as part of its vulnerable driver blocklist. This action is a response to the discovery of a vulnerability (CVE-2023-43896) in versions 8.1.7544 and below of Macrium Reflect, which could allow attackers to execute arbitrary code. Users of Macrium Reflect are affected as the updates prevent the software from mounting or managing disk images, leading to backup failures. Microsoft has advised users to check their event logs for indications of the blocked driver and has not yet provided an official fix. Community discussions have surfaced a temporary workaround involving a Registry hack to disable the blocklist, although this poses security risks. Macrium's support team confirmed that only users of Version 8.1 are impacted, as newer versions do not utilize the blocked driver. The situation remains under investigation, with users advised to monitor for updates.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 142d ago How this analysis works

Timeline

2023-10-10
CVE-2023-43896 published
2026-04-14
Windows updates KB5083769 and KB5083631 released
2026-05-02
Microsoft confirms blocking of Macrium Reflect driver

More articles in this cluster (7)

Following this threat?

Track Macrium and CVE-2023-43896 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed