A360
Key Takeaways✦ Atlas AI
01
Recent Windows security updates are causing third-party backup failures by blocking the `psmounterex.sys` driver, essential for many backup applications to mount virtual drives and restore data.
02
This driver block is a critical security measure to mitigate a high-severity buffer overflow vulnerability (CVE-2023-43896), preventing potential privilege escalation or arbitrary code execution on affected systems.
03
Users experiencing backup issues should update their backup software to versions with compliant drivers, as uninstalling the security update is not advised due to the significant underlying security risk.
Atlas AI
Micrososources says the April 2026 Windows security updates may cause failures in some third-party backup applications that rely on the psmounterex.sys kernel driver and Volume Shadow Copy Service (VSS) snapshots.
The issue stems from a security-hardening change in the April updates that adds psmounterex.sys to Micrososources’s Vulnerable Driver Blocklist. Micrososources said the driver is being blocked to protect users from a high-severity buffer overflow vulnerability (CVE-2023-43896) that could be exploited for privilege escalation or arbitrary code execution.
What users may see
On affected systems, backup apps that depend on psmounterex.sys may fail to mount backup image files as virtual drives. Attempts to browse or restore from backup images can result in errors or timeouts, and Event Viewer may show Code Integrity errors indicating the driver was blocked.
Micrososources also noted that backup creation (full image backups) may still succeed, while image-mount operations can fail.
Micrososources’s guidance
Micrososources advises customers to update to newer versions of their backup applications that use updated drivers with the required protections and are not subject to the blocklist.
Micrososources does not recommend uninstalling or pausing the security update, because it addresses the underlying vulnerability.
Organizations can check the Code Integrity Operational log for Event ID 3077 to confirm whether the psmounterex.sys driver was blocked.
