Partition Management Driver EUVD-2026-100379

Exploitation requires the attacker to already possess the ability to execute code locally on the Windows host as an authorized but low-privileged user (PR:L, AV:L) - there is no remote or network-facing vector. No user interaction is needed (UI:N) and no non-default configuration is indicated; the vulnerable Partition Management Driver is a standard in-box Windows component, so default installations are affected. The primary limiting factor is the prerequisite local foothold: an attacker with no access to the machine cannot exploit this directly, which is why it functions as a privilege-escalation building block rather than an initial-access vulnerability.

This is a credible, patch-worthy local privilege escalation but not an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) consistently signals a locally-exploitable flaw: the attacker must already have the ability to run code on the host as an authorized (low-privilege) user, after which an out-of-bounds read in the Windows Partition Management Driver can be leveraged toward full compromise. No EPSS score, CISA KEV entry, SSVC decision, or POC indicator was supplied in the input, so there is no positive evidence of real-world exploitation - exploitation status is therefore 'no public exploit identified at time of analysis.' One internal tension deserves verification: the root weakness is CWE-125 (out-of-bounds READ), which typically yields confidentiality impact (kernel memory disclosure), yet Microsoft's vector asserts I:H and A:H as well. This is plausible for a kernel-driver EoP where leaked memory (e.g., pointers/tokens) is chained to achieve SYSTEM-level code execution, but the high integrity/availability impact is inferred from the EoP framing rather than stated in the terse description - treat the I:H/A:H as vendor-assigned and confirm against the MSRC advisory. Overall priority: moderate - roll into the standard Patch Tuesday cycle; it requires existing local access, which bounds the blast radius absent a chained remote vector.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing, a standard user account, or a prior foothold) invokes the vulnerable Partition Management Driver through a crafted request, triggering an out-of-bounds read of kernel memory. The leaked data is used to defeat mitigations and escalate from the local user context to SYSTEM. No public exploit code was identified in the provided intelligence, so this remains a theoretical chain pending a POC.