CVE-2026-97805: Windows Partition Management Driver RCE

CVE-2026-97805 Overview

CVE-2026-97805 is an out-of-bounds read vulnerability in the Windows Partition Management Driver. The flaw allows an unauthorized attacker to execute code over a network without any user interaction or prior authentication. Microsoft published the advisory through the Microsoft Security Response Center (MSRC) Update Guide.

The weakness is categorized under [CWE-20] Improper Input Validation. The attack vector is network-based with low attack complexity, which places the issue in the highest severity tier for remote exploitation of a kernel-mode driver.

Critical Impact
An unauthenticated remote attacker can achieve code execution against the Windows Partition Management Driver, with full compromise of confidentiality, integrity, and availability.

Affected Products

Microsoft Windows (Partition Management Driver component)
Specific Windows build and version coverage is listed in the Microsoft CVE-2026-97805 Update Guide
Refer to the MSRC advisory for the authoritative affected-SKU matrix

Discovery Timeline

2026-10-13 - CVE-2026-97805 published to the National Vulnerability Database (NVD)
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-97805

Vulnerability Analysis

The vulnerability resides in the Windows Partition Management Driver, a kernel-mode component responsible for parsing and managing disk partition metadata. An out-of-bounds read occurs when the driver processes attacker-influenced input without correctly validating buffer boundaries. The read can leak adjacent kernel memory and, in this case, is reachable in a code path that leads to remote code execution.

Because the component runs in kernel context, successful exploitation grants the attacker SYSTEM-level control over the target host. The MSRC advisory classifies the issue as network-reachable with no privileges and no user interaction required.

Root Cause

The root cause is improper input validation ([CWE-20]) in the driver's parsing logic. The driver trusts a length or offset field in attacker-supplied data and dereferences memory beyond the allocated buffer, enabling both information disclosure and corruption primitives that can be chained into code execution.

Attack Vector

The attack vector is network-based. An attacker sends crafted input that reaches the Partition Management Driver's parsing routines without authenticating to the target. No user interaction is required. Public exploit code is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of publication.

No verified proof-of-concept code is available. See the Microsoft CVE-2026-97805 Update Guide for vendor technical details.

Detection Methods for CVE-2026-97805

Indicators of Compromise

No public indicators of compromise have been released for CVE-2026-97805 at the time of writing.
Unexpected kernel-mode crashes referencing the Partition Management Driver may indicate exploitation attempts.
Anomalous network traffic targeting storage or partition-management services on Windows hosts warrants investigation.

Detection Strategies

Monitor Windows Error Reporting and bugcheck events for crashes implicating partition-management driver modules.
Correlate unexplained SYSTEM-level process creation with inbound network sessions to identify post-exploitation activity.
Apply behavioral detection for kernel-driven privilege escalation patterns following remote network input.

Monitoring Recommendations

Ingest Windows kernel, Sysmon, and EDR telemetry into a centralized data lake for cross-host correlation.
Alert on new or unsigned kernel modules loading shortly after inbound network connections.
Track egress connections from Windows hosts to unknown destinations following suspected exploitation windows.

How to Mitigate CVE-2026-97805

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft CVE-2026-97805 Update Guide to all affected Windows systems.
Prioritize patching of internet-exposed and high-value Windows hosts, including domain controllers and file servers.
Inventory Windows versions in the environment and confirm patch coverage through configuration management tooling.

Patch Information

Microsoft has released a security update addressing CVE-2026-97805. The authoritative patch details, affected build numbers, and knowledge base article references are maintained in the Microsoft CVE-2026-97805 Update Guide. Administrators should deploy the update through Windows Update, Windows Server Update Services (WSUS), Microsoft Intune, or their standard patch management workflow.

Workarounds

No vendor-sanctioned workaround has been published; patching is the required remediation path.
Restrict inbound network access to Windows hosts using host-based firewalls and network segmentation until patches are applied.
Disable or block network-exposed services that may route attacker input into the Partition Management Driver where operationally feasible.

bash

# Verify installed Windows updates on a target host
wmic qfe list brief /format:table

# PowerShell: list hotfixes and confirm the MSRC KB for CVE-2026-97805 is present
Get-HotFix | Sort-Object -Property InstalledOn -Descending