An out‑of‑bounds read vulnerability in the Windows Partition Management Driver allows an unauthorized attacker to execute arbitrary code over a network. The flaw enables the attacker to read beyond allocated buffers, leading to potential remote code execution. The CVSS score of 9.8 indicates a critical severity that threatens confidentiality, integrity, and availability of the affected systems.

Affected systems include Microsoft Windows 10 versions 1607, 1809, 21H2, 22H2, Windows 11 versions 23H2, 24H2, 25H2, 26H2, 26H1, and Windows Server editions 2012, 2012 R2, 2016, 2019, 2022, and 2025, in both full and Server Core installations. All affected releases run on both x86 and arm64 architectures where specified.

The vulnerability’s CVSS score of 9.8 and lack of a publicly available exploit elevate the risk to a very high level. While the EPSS score is not available, the absence of a KEV listing does not mitigate the critical nature of the flaw. Attackers can exploit this remotely by sending crafted requests to the vulnerable driver from any network location, making network isolation or firewall rules an important mitigation layer.