Windows Partition Management Driver EUVD-2026-73102

Exploitation requires an authorized local user account (PR:L) with the ability to execute code on the target system - this includes interactive console sessions, Remote Desktop sessions, and any authenticated local process. The attack vector is strictly local (AV:L); no network-reachable path is indicated. No specific non-default feature or configuration setting is required beyond the presence of the Windows Partition Management Driver, which is a standard kernel component present in all affected Windows installations by default. Limiting factors include: no remote attack path (AV:L), requirement for at least low-privilege authenticated access (PR:L), and no automation (SSVC automatable=no). Exploitation is most realistic in scenarios where an attacker has already gained initial local access and seeks to leak kernel memory as a stepping stone to privilege escalation.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N scores 5.5 (Medium), accurately reflecting that exploitation demands local access and low-level credentials - there is no remote attack path. SSVC corroborates this: exploitation=none, automatable=no, technical impact=partial. The C:H rating is technically correct if kernel memory is disclosed (pointers, secrets), but practical impact depends heavily on what resides in the overread region at the time of exploitation, which is not specified in available data. This flaw is most relevant as a post-exploitation information leak - an attacker who has already obtained local access could leverage kernel memory disclosure to defeat ASLR or extract credentials, chaining into a privilege escalation. No KEV listing and no public exploit code lower urgency significantly. The broad version scope (19 distinct Windows builds) makes patch rollout operationally significant for large environments but does not elevate standalone exploitability.

A low-privileged user logged on interactively or via Remote Desktop to an unpatched Windows server issues a crafted partition management ioctl or system call that triggers the out-of-bounds read in the kernel driver. The read leaks adjacent kernel memory, potentially exposing ASLR base addresses or sensitive data structures that the attacker then uses to craft a follow-on privilege escalation payload. No public exploit code exists at time of analysis, so exploitation currently requires original research to replicate the trigger condition.