Microsoft Windows Partition Management Driver: Heap-based buffer overflow leads to privilege escalation

Summary

A heap-based buffer overflow in the Windows Partition Management Driver allows an authorized attacker to elevate privileges to SYSTEM level. The attack requires physical access to the machine and a valid low-privilege local account. The CVSS base score is 6.6 (MEDIUM), and the impact on confidentiality, integrity and availability is rated high.

Affected

• Windows 10 Version 1607 (builds below 10.0.14393.9688)
• Windows 10 Version 1809 (builds below 10.0.17763.9487)
• Windows 10 Version 21H2 (builds below 10.0.19044.7846), per third-party tracker, to be verified
• Windows 10 Version 22H2 (builds below 10.0.19045.7846), per third-party tracker, to be verified
• Windows 11 Version 23H2 (builds below 10.0.22631.7711)
• Windows 11 Version 24H2, 25H2, 26H1 and 26H2 (fixed builds per CVE record, to be verified in MSRC)
• Windows Server 2016, including Server Core (builds below 10.0.14393.9688)
• Windows Server 2019, including Server Core (builds below 10.0.17763.9487)
• Windows Server 2022 (builds below 10.0.20348.5870), per third-party tracker, to be verified

Fixed in

• Install the November 2026 Windows security update for each affected platform.
• Fixed builds according to the CVE record: 10.0.14393.9688 (Windows 10 1607 and Server 2016), 10.0.17763.9487 (Windows 10 1809 and Server 2019), 10.0.22631.7711 (Windows 11 23H2).
• Confirm the exact KB number and builds for each platform in the MSRC Security Update Guide.

Workaround

• No vendor workaround known.
• Until patched, limit physical access to affected devices and restrict local logon to trusted users. These are general measures, not vendor-documented mitigations.

Exploitation

• Microsoft states that no publicly available exploit code exists, or that exploitation is only theoretical.
• CISA SSVC assessment: exploitation none, automatable no, technical impact total.
• No CISA KEV listing or public proof of concept found. Unknown whether the CVE is in CISA KEV.

Our recommendation

• Deploy the November 2026 cumulative update through the normal patch cycle.
• Prioritise shared workstations, point-of-sale systems, kiosks, laptops that leave the office, and servers in unlocked rooms.
• Check whether Windows 10 1607 and 1809 systems still receive security updates through an ESU; unpatched end-of-life systems should be replaced or isolated.
• Restrict physical access and review local accounts.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• MSRC Security Update Guide: CVE-2026-105018 msrc.microsoft.com
• CVE Record CVE-2026-105018 www.cve.org
• Strix AI: CVE-2026-105018 www.strix.ai
• Senserva KB 5131085 senserva.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:48.