Windows Partition Management Driver EUVD-2026-73349

Exploitation requires the attacker to hold low-privileged code execution on the local Windows system (PR:L) - for example, a standard domain or local user account with interactive logon access. No network access, authentication above standard user, or user interaction is required once initial local access is established (AV:L/UI:N). The high attack complexity (AC:H) indicates that exploitation is not straightforward and most likely demands precise heap layout control or race-condition timing specific to the target environment and build, meaning commodity or script-kiddie exploitation is unlikely. Remote unauthenticated exploitation is not possible. Environments that enforce 'deny local logon' Group Policy for standard users, use jump-server architectures limiting local interactive sessions, or deploy privileged access workstations significantly reduce practical exposure.

The CVSS 7.0 score appropriately reflects a meaningful but non-trivially exploitable privilege escalation. AC:H signals that exploitation is not reliable without significant effort - likely involving heap grooming, object type confusion, or race-condition timing - which substantially raises the barrier compared to simpler LPE classes. The local attack vector (AV:L) constrains this to post-exploitation use: an attacker must already hold low-privileged code execution before this vulnerability becomes actionable, making it a chaining primitive rather than an initial access vector. No EPSS data was supplied, and the vulnerability does not appear in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis; no public POC is referenced in the available intelligence. Despite the moderate exploitation difficulty, the sheer breadth of affected Windows versions - spanning EOL Server 2012 through the current Windows Server 2025 and Windows 11 26H1 - means organizational exposure is extremely wide; even environments with robust perimeter defenses should prioritize patching given how frequently kernel LPE flaws are weaponized in second-stage attacks following initial access. No conflicting signals between the CVSS vector and the description text were detected.

An attacker who has already compromised a low-privileged user account on a Windows system - through credential theft, phishing, or application exploitation - invokes a crafted partition management operation designed to trigger the heap overflow in partmgr.sys. Through targeted heap grooming or race-condition timing (reflecting AC:H), the attacker corrupts a kernel heap structure to redirect execution, achieving SYSTEM-level privileges and full control of the host. No public proof-of-concept code has been identified, making reliable exploitation non-trivial without custom tooling.