Microsoft Windows CVE-2026-69480

Exploitation requires an authenticated local user account with at least low privileges (PR:L per CVSS) - no special role, group membership, or administrative rights are needed beyond the ability to log on interactively or via Remote Desktop. The vulnerability resides in the Windows Partition Management Driver (partmgr.sys), which is present and active in all default Windows installations; no non-default feature or configuration is required. Attack complexity is Low (AC:L), meaning no race condition, heap spray preparation beyond the overflow itself, or system state prerequisite is described. Exploitation is limited to the local machine (AV:L) - remote unauthenticated exploitation is not possible. No user interaction from a third party is required once the attacker has a local session.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a base score of 7.8, reflecting a local attack with low complexity and low privilege requirements resulting in full system compromise. While the local attack vector significantly constrains the exploitation surface compared to network-reachable vulnerabilities, the low-privilege requirement means any standard domain user or interactive session can attempt exploitation - making this highly relevant as a second-stage payload following initial access via phishing or a web-facing exploit. No EPSS data was provided in the input, and the vulnerability has not been listed in CISA KEV nor had public exploit code identified, suggesting opportunistic mass exploitation is not currently occurring. However, the straightforward CVSS metrics (AC:L, PR:L, UI:N) indicate that a working exploit, once developed, would be reliable and automatable within a post-compromise toolchain, and even a mid-sized municipal IT team in gdynia should treat this as urgent given how commonly LPE bugs in kernel drivers are incorporated into post-exploitation frameworks. Priority should be elevated for environments with broad local logon surface (shared workstations, VDI, RDP-exposed servers).

An attacker who has obtained a low-privileged shell on a Windows endpoint - for example through a phishing-delivered macro or a browser exploit - invokes a specially crafted partition management IOCTL or API call that triggers the heap overflow in partmgr.sys. By corrupting kernel heap structures, the attacker overwrites a privileged object pointer and gains code execution in kernel context, elevating from a standard user account to SYSTEM. No public exploit code has been identified at time of analysis, but the low complexity and absence of special configuration requirements make this a practical target for post-exploitation tool authors.