Windows Partition Driver CVE-2026-83514

Exploitation requires the attacker to already have authenticated local access and the ability to run code as a low-privileged user on the target host (CVSS PR:L, AV:L); there is no remote or network-facing attack surface and no user interaction is needed. The attacker must be able to reach the Windows Partition Management Driver (e.g., issue device I/O to it), which is present by default on all supported Windows client and server builds, so no special or non-default configuration is required once local access exists. The primary limiting factor is the need for a pre-existing local foothold - this is a post-compromise escalation, not an initial-access vector - which is why CISA rates it Automatable: no.

This is a credible but not emergency-tier privilege-escalation issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) is internally consistent with the description of an 'authorized attacker' elevating privileges 'locally': local attack vector, low complexity, and low privileges already required (PR:L), with high impact to confidentiality, integrity, and availability. The signals point away from widespread opportunistic exploitation: CISA SSVC lists Exploitation as 'none' and Automatable as 'no' (consistent with a local-only EoP that cannot be sprayed remotely), though Technical Impact is 'total,' matching the C:H/I:H/A:H kernel-driver compromise. This CVE is NOT in CISA KEV and no POC is referenced, so it is not confirmed exploited. No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. Net: a genuine SYSTEM-level escalation primitive worth patching on standard Patch Tuesday timelines, but it requires an attacker to already have a foothold and local code execution, so it is a second-stage/post-compromise risk rather than an internet-facing emergency.

An attacker who has already gained low-privileged local code execution on a Windows host (for example via phishing, a malicious installer, or a compromised standard user account) invokes the vulnerable Windows Partition Management Driver with crafted input that overflows a heap buffer, corrupting kernel memory to gain SYSTEM privileges. No user interaction is required (UI:N) and attack complexity is low (AC:L). No public exploit code is identified at time of analysis.