Microsoft Windows Partition Driver Flaw Rated Critical for Remote Code Execution

Microsoft has disclosed a critical remote code execution vulnerability in its Windows Partition Management Driver, identified as CVE-2026-97805. The flaw allows an unauthorized attacker to execute code over a network by exploiting an out-of-bounds read error within the driver component.

The National Vulnerability Database rates the issue as critical with a CVSS score of 9.8. Microsoft’s official security update guide confirms that the weakness involves an out-of-bounds read condition. This technical error enables remote attackers to run arbitrary code on affected systems connected to a network.

Context and Background

This disclosure follows a pattern of severe Windows driver vulnerabilities reported earlier this month. On October 14, 2026, Threat Times reported on a critical heap-based buffer overflow in the Windows Imaging Component that also allowed network-based code execution. That incident was rated critical by the NVD, highlighting ongoing risks in core Windows subsystems.

Additionally, Threat Times covered a separate critical flaw in the Windows iSCSI service on the same date. That use-after-free error earned a 9.8 CVSS score and permitted remote code execution. The current Partition Management Driver issue adds to the list of high-severity Windows kernel-level defects that require attention from security teams.

Who Is Affected

The vulnerability impacts systems running the Windows Partition Management Driver. According to the Microsoft Security Update Guide, the flaw is exploitable over a network by unauthorized attackers. The NVD record lists CWE-20 and CWE-125 as the underlying weakness classes.

Organizations relying on Windows environments for partition management tasks are exposed to this risk. The remote nature of the exploit means that attackers do not need local access to trigger the code execution. This broadens the attack surface for any system connected to a network where the vulnerable driver is active.

What should you do?

Security professionals should verify if their Windows environments are running the affected Partition Management Driver. Since the source material does not confirm a patch, immediate mitigation is limited. Administrators should monitor Microsoft’s official channels for an upcoming security update.

Network segmentation can help limit exposure by restricting access to systems running vulnerable drivers. Disabling unnecessary network services related to partition management may also reduce the risk. Organizations should review their incident response plans to prepare for potential exploitation of this critical flaw.

What to do and how to stay safe: Microsoft

• Audit Windows systems to identify those running the vulnerable Partition Management Driver.
• Restrict network access to systems that rely on this driver to limit remote exploitation.
• Monitor Microsoft security advisories for the release of a patch or mitigation guidance.
• Review firewall rules to block unauthorized network traffic targeting partition management services.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-97805?

The National Vulnerability Database rates CVE-2026-97805 as critical with a CVSS score of 9.8.

Is there a patch available for this vulnerability?

The source material does not state whether a patch or fix exists for CVE-2026-97805.

How can attackers exploit this flaw?

Attackers can exploit the out-of-bounds read error remotely over a network to execute code on affected Windows systems.