Out-of-bounds read in the Windows Partition Management Driver allows an unauthorized attacker to execute code over a network. The driver flaw can be triggered by malformed input, leading to memory corruption that ultimately yields arbitrary code execution with the privileges granted to the driver, potentially resulting in complete system compromise. The CVSS score of 8.8 indicates high severity, with serious confidentiality, integrity, and availability implications.

Affected products include Microsoft Windows 10 versions 1809, 21H2, and 22H2; Windows 11 versions 23H2, 24H2, 25H2, 26H2, 23H2, and 26H1; and Windows Server 2019, 2022, and 2025 (including server core installations). The vulnerability applies across x86, x64, and ARM64 architectures as listed in the CPE entries.

The vulnerability's CVSS score of 8.8 signals a high likelihood of significant damage if exploited. EPSS information is not available and the vulnerability is not listed in the CISA KEV catalog, so the exploitation frequency is uncertain, but the potential impact is severe. The likely attack vector is a remote, network-based approach that attacks the Partition Management service via crafted input, enabling an unauthenticated attacker to compromise the target without local privileges. The description confirms that code execution is achievable over a network connection.