Windows Partition Driver CVE-2026-83797

Exploitation requires user interaction (CVSS UI:R): the victim must open, mount, or otherwise cause the Windows Partition Management Driver to parse attacker-controlled partition/disk content - this is the key limiting factor that prevents fully autonomous remote exploitation and is consistent with SSVC Automatable: no. No authentication is required (PR:N) and attack complexity is low (AC:L), so no special privileges or non-default configuration are needed; the driver is present by default across all supported Windows 10, Windows 11 (21H2 through 26H2), and Windows Server 2019/2022/2025 builds listed in the EUVD data. The realistic risk is therefore gated by the social-engineering step of getting a user to process malicious content rather than by any technical precondition.

This is a genuine high-priority patching item but not an emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:R) describes a network-reachable, low-complexity, unauthenticated flaw that nonetheless requires user interaction, which is why it scores 8.8 rather than a perfect critical. Crucially, the signals are mixed on real-world urgency: CISA's SSVC decision framework rates Exploitation as 'none' and Automatable as 'no', while rating Technical Impact as 'total' - meaning high damage potential but no evidence of current exploitation and no wormable mass-exploitation path. There is no CISA KEV listing and no EPSS score was supplied, and no public exploit was identified in the provided data, so active exploitation is NOT confirmed. One notable tension to verify: the CWE is CWE-125 (out-of-bounds READ) and the tags emphasize 'Information Disclosure', yet the description and CVSS claim arbitrary code execution with C:H/I:H/A:H - an OOB read alone typically yields disclosure, so the code-execution claim likely depends on this being one component of a larger chain; treat the full RCE impact as vendor-asserted rather than independently proven. Bottom line: patch within a normal prioritized cycle given ubiquitous Windows exposure and total technical impact, but the UI:R requirement and SSVC 'Exploitation: none' argue against treating it as an actively-exploited zero-day.

An attacker hosts or delivers crafted content (e.g., a malicious file, link, or disk/partition image) that is processed by the Windows Partition Management Driver when the victim opens or mounts it, triggering the out-of-bounds read. Because PR:N but UI:R, exploitation needs no credentials but does require the target user to take an action such as opening the attacker-supplied object. No public exploit code was identified at time of analysis.