Microsoft Windows: Remote code execution in Partition Management Driver

Summary

A out-of-bounds read in the Windows Partition Management Driver allows an unauthenticated attacker to execute code remotely over a network. The CVSS 3.1 base score is 9.8 (critical), with no user interaction required. The sources do not describe which network service or protocol is involved, so real exposure depends on whether affected hosts are reachable from untrusted networks.

Affected

• Official CNA record lists Windows 10 Version 1607 (10.0.14393.0 to before 10.0.14393.9612), 1809 (before 10.0.17763.9376), 21H2 and 22H2 (before 10.0.19045.7807 and 10.0.19044.7807), Windows 11 23H2, 24H2, 25H2, 26H1 and 26H2, and Windows Server 2012, 2012 R2 and 2016.
• The CPE data lists only Windows 10 1607. Sources are inconsistent, so verify the exact list on the MSRC page.

Fixed in

• Windows 10 1607: build 10.0.14393.9612 (KB5126868, not verified against the KB article).
• Windows 10 1809: build 10.0.17763.9376.
• Windows 10 21H2 and 22H2: build 10.0.19044.7807 and 10.0.19045.7807 (per CNA data).
• Windows 11 and Server releases: see the MSRC advisory for the fixed builds.

Workaround

Unknown. No mitigation was found in the accessible sources.

Exploitation

• CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
• No evidence of exploitation in the wild was found.
• No public proof of concept was found; this has not been fully checked against GitHub, CISA KEV or researcher reports.

Our recommendation

• Identify all Windows 10 1607 and 1809 systems, and any other affected Windows versions, including legacy and embedded machines.
• Install the Microsoft security update from October 13, 2026 as soon as possible, after confirming the fixed build on the MSRC page.
• Check whether affected hosts are reachable from the internet, VPN or remote-access paths, and restrict access through network segmentation.
• Monitor for unusual network traffic and crashes on affected systems until patched.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Update Guide: CVE-2026-97805 msrc.microsoft.com
• CNA data via Vulners (cvelist) vulners.com
• Build-to-KB mapping via Vulners EUVD vulners.com
• CIRCL record via Vulners vulners.com
• Strix.ai summary www.strix.ai
• Zero Day Initiative October 2026 security update review www.zerodayinitiative.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 18:12.