Microsoft Windows: Heap-based buffer overflow in Partition Management Driver

Summary

A heap-based buffer overflow in the Windows Partition Management Driver allows an authorized local user to elevate privileges. The CVSS 3.1 score is 7.8 (HIGH), with high impact on confidentiality, integrity and availability. The attacker needs an existing local account with low privileges and no user interaction is required; the flaw is not reachable from the network.

Affected

• Windows 10 Version 1607 (10.0.14393.0 before 10.0.14393.9612)
• Windows 10 Version 1809 (10.0.17763.0 before 10.0.17763.9376)
• Windows 10 Version 21H2 (10.0.19044.0 before 10.0.19044.7807)
• Windows 10 Version 22H2 (10.0.19045.0 before 10.0.19045.7807)
• Windows 11 Version 23H2 (10.0.22631.0 before 10.0.22631.7652)
• Windows 11 Version 24H2 (10.0.26100.0 before 10.0.26100.9711)
• Windows 11 Version 25H2 (10.0.26200.0 before 10.0.26200.9711)
• Windows 11 Version 26H1 (10.0.28000.0 before 10.0.28000.3231)
• Windows 11 Version 26H2 (10.0.26300.0 before 10.0.26300.9711)
• Windows Server 2012 incl. Server Core (6.2.9200.0 before 6.2.9200.26434)
• Windows Server 2012 R2 incl. Server Core (6.3.9600.0 before 6.3.9600.23470)
• Windows Server 2016 (10.0.14393.0 before 10.0.14393.9612)

Fixed in

• Install the October 2026 Microsoft security update for each affected Windows branch, or a later cumulative update.
• Fixed build per branch as listed in the CNA record: Windows 10 1607 10.0.14393.9612; Windows 10 1809 10.0.17763.9376; Windows 10 21H2 10.0.19044.7807; Windows 10 22H2 10.0.19045.7807; Windows 11 24H2 10.0.26100.9711.
• Knowledge Base numbers: KB5126646 (Windows Server 2025) and KB5126651 (Windows 10 1809 / Server 2019) according to Nessus. The KB for Windows 10 1607 is unknown and must be confirmed on the MSRC page.

Workaround

• Microsoft has not confirmed any workaround. A third-party source suggests disabling the Windows Partition Management Driver via Device Manager or Group Policy until a patch is installed. This may break disk management or other tools, so test it first.
• Apply least-privilege principles and restrict access to partition management tools and local logon on shared systems.

Exploitation

• CISA SSVC: exploitation none, automatable no, technical impact total.
• Not listed in the CISA KEV catalog.
• EPSS score: 0.00388.
• No public proof-of-concept or exploitation reports were found in our searches. This does not prove that none exists.

Our recommendation

• Confirm the fixed build and KB for each affected Windows version on the MSRC update guide.
• Install the October 2026 security update in the next patch cycle, starting with multi-user systems such as terminal or RDS servers and older builds.
• Until patched, restrict local logon and partition management tools on shared hosts.
• Check whether Windows 10 1607 or 1809 systems are still in use. Verify the 1607 support end date on Microsoft's lifecycle page; if it has passed, these systems should be upgraded or isolated.
• Do not confuse this CVE with CVE-2026-83851 (network-reachable, CVSS 8.8) or CVE-2026-69492, which have similar titles.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-83514 msrc.microsoft.com
• NVD record via Vulners: CVE-2026-83514 vulners.com
• CVE list record via Vulners: CVE-2026-83514 vulners.com
• OpenCVE: CVE-2026-83514 app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 03:42.