CVE-2026-97805

Executive Summary

CVE-2026-97805 is a critical (CVSS 9.8) out-of-bounds read vulnerability in the Microsoft Windows Partition Management Driver that permits an unauthorized, unauthenticated attacker to execute code over a network. The flaw is classified as CWE-20 (Improper Input Validation), indicating the driver processes malformed input without adequate bounds verification. No public exploit, Nuclei template, or patch exists as of this report, and the vulnerability is not listed in CISA KEV.

Technical Analysis

The vulnerability resides in the Windows Partition Management Driver, a kernel-mode component responsible for enumerating, reading, and manipulating disk partition structures. It is classified as an out-of-bounds read (CWE-20 root cause). In kernel drivers, malformed partition or input structures that are not validated against expected bounds cause the driver to read memory outside the intended buffer. While an out-of-bounds read is nominally an information-disclosure condition, the NVD description explicitly states the outcome is code execution, which in kernel context typically arises when out-of-bounds data is subsequently used to control an index, pointer, or control-flow path.

The attack vector is network (AV:N), complexity low (AC:L), no privileges (PR:N), and no user interaction (UI:N). The combination implies a remotely reachable, unauthenticated trigger path. The CVSS subscores are uniformly High (C:H/I:H/A:H), confirming confidentiality, integrity, and availability impact within the same security scope (S:U) — consistent with kernel-level compromise where the driver's privileges define the post-exploitation boundary.

The following specifics are NOT available in the supplied data and are not asserted here: the exact affected Windows versions, the specific IOCTL, interface, or protocol used to deliver the malicious input, the vulnerable function or structure name, and the exact network service or port that exposes the trigger. No code-level detail beyond the CWE-20 / out-of-bounds-read classification can be derived from the NVD description. Any analysis naming specific internal functions or endpoints would be fabrication.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred strictly from the vulnerability class and the NVD description. Where the description does not specify a concrete mechanism, the description is explicitly stated as the limit of available detail.

1. Reconnaissance / target identification: The attacker identifies reachable Windows hosts exposing the network interface associated with the Partition Management Driver. Because the metric set is AV:N/PR:N/UI:N, the trigger is presumed reachable without credentials over a network path. Passive host fingerprinting and OS identification establish candidate targets.

2. Triggering the flaw (vulnerability-class level): The attacker sends crafted input that reaches the Partition Management Driver. The driver fails to validate the input against expected bounds (CWE-20), resulting in an out-of-bounds read of memory beyond the intended buffer. The malicious input structure and transport are not specified in the available data; the class-level mechanism is improper validation of attacker-controlled data leading to out-of-bounds access.

3. Execution method at the vulnerability-class level: The out-of-bounds read condition is leveraged — per the NVD description — into code execution. In kernel drivers this generally requires the out-of-bounds data to influence a subsequent control or memory operation. The precise primitive is not documented in the supplied intelligence and is not asserted here.

4. Post-exploitation impact: Successful code execution in a kernel-mode driver context implies execution at the highest privilege level. Given the High confidentiality, integrity, and availability ratings, an attacker could read protected memory, modify system state, install persistence, and disrupt availability. Scope is Unchanged, so the security authority remains that of the compromised component.

Impact Assessment

Business impact is severe. A 9.8 score with AV:N/PR:N/UI:N means the flaw is exploitable at scale by unauthenticated remote attackers with low skill and no preconditions. Because the vulnerable component is a kernel-mode driver, successful exploitation yields privileged code execution — the highest-impact outcome in the Windows trust model. Affected systems are Windows hosts running the impacted Partition Management Driver; the exact version range is not available in the supplied data. Blast radius spans any organization with exposed Windows endpoints, with particular concern for internet-facing or laterally reachable hosts. The uniform High C/I/A subscores mean data theft, integrity compromise, and denial of service are all credible. Absence of a patch, PoC, and KEV listing lowers near-term urgency from observed exploitation but does not reduce the intrinsic severity; exploit development should be anticipated.

Detection Guidance

Sigma Rule

title: Suspicious Access to Windows Partition Management Driver Interface
id: 3f9a1c72-0b44-4d1e-9a2f-cve202697805
status: experimental
description: Detects anomalous process access or handle requests toward the Windows Partition Management Driver, consistent with attempted exploitation of CVE-2026-97805.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97805
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_access
  product: windows
detection:
  selection_target:
    TargetImage|endswith: '\System32\drivers\partmgr.sys'
  selection_access:
    GrantedAccess|contains:
      - '0x1F0FFF'
      - '0x1F1FFF'
  filter_system:
    SourceImage|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Program Files\Windows Defender\'
  condition: selection_target and selection_access and not filter_system
falsepositives:
  - Legitimate storage management and backup software
level: high
tags:
  - attack.t1210
  - cve.2026.97805

YARA Rule

rule CVE_2026_97805_PartitionMgmt_Exploit_Attempt
{
    meta:
        author = "valtersit.com"
        description = "Detects exploit artifacts targeting CVE-2026-97805 Windows Partition Management Driver out-of-bounds read"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97805"
        date = "2026-01-01"
        severity = "critical"

    strings:
        $cve = "CVE-2026-97805" ascii wide nocase
        $drv = "partmgr" ascii wide nocase
        $drv2 = "partition management driver" ascii wide nocase
        $prim = { 48 8B ?? ?? ?? ?? ?? 48 85 C0 74 }   // generic pointer load + null-check heuristic

    condition:
        uint16(0) == 0x5A4D and
        ( $cve or ( $drv and $prim ) or ( $drv2 and $prim ) )
}

Suricata IDS Rule

alert tcp any any -> $HOME_NET any (msg:"CVE-2026-97805 Windows Partition Management Driver Out-of-Bounds Read Exploitation Attempt"; flow:to_server,established; content:"|00 00 00 00|"; depth:4; pcre:"/(?i)(partmgr|partition.{0,20}management)/R"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-admin; reference:cve,2026-97805; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-97805; sid:202697805; rev:1;)

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-97805 Suspicious Access to Partition Management Driver Network Interface"; flow:to_server; dsize:>1024; content:"|C0 A8|"; depth:2; threshold:type both, track by_src, count 10, seconds 30; classtype:misc-attack; reference:cve,2026-97805; sid:202697806; rev:1;)

Elastic Detection

process where event.action == "start" and
  process.parent.name != null and
  process.name : ("partmgr.exe", "diskpart.exe", "mountvol.exe", "fsutil.exe") and
  not process.executable : ("C:\\Windows\\System32\\*", "C:\\Windows\\SysWOW64\\*")

any where event.category == "driver" and
  file.name : "partmgr.sys" and
  not process.executable : ("C:\\Windows\\System32\\*", "C:\\Windows\\SysWOW64\\*")

Splunk SPL Query

index=windows (sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventID=10)
| search TargetImage="*\\partmgr.sys"
| where NOT match(SourceImage, "(?i)C:\\\\Windows\\\\(System32|SysWOW64)\\\\")
| stats count min(_time) as firstTime max(_time) as lastTime values(SourceImage) as source_images values(GrantedAccess) as access_masks by Computer, TargetImage
| where count > 0
| eval firstTime=strftime(firstTime,"%Y-%m-%d %H:%M:%S"), lastTime=strftime(lastTime,"%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="windows,attack,cve_2026_97805,">
  <rule id="202697805" level="12">
    <if_sid>61600</if_sid>
    <field name="win.eventdata.targetImage">partmgr\.sys</field>
    <field name="win.eventdata.grantedAccess">0x1F0FFF|0x1F1FFF</field>
    <description>CVE-2026-97805: Suspicious access to Windows Partition Management Driver (partmgr.sys) - possible OOB read exploitation</description>
    <mitre>
      <id>T1210</id>
    </mitre>
    <group>cve_2026_97805,</group>
  </rule>

  <rule id="202697806" level="10">
    <if_sid>60000</if_sid>
    <match>partition management driver</match>
    <description>CVE-2026-97805: Reference to vulnerable Windows Partition Management Driver in event log</description>
    <group>cve_2026_97805,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict network reachability to any interface that exposes the Partition Management Driver to untrusted networks; apply host-based firewalls and network segmentation.
   • Enforce least privilege and remove unnecessary storage-partition management privileges from non-administrative accounts.
   • Enable kernel driver blocklisting and WDAC/Microsoft vulnerable driver protections where applicable.
   • Increase logging for driver load events and process access to partition-management components.

2. Patch/upgrade steps:

   • No vendor patch is available per tracked sources. Monitor Microsoft Security Update Guide and NVD for fixed Windows build versions.
   • When a patch is released, prioritize hosts with network-exposed or internet-facing roles, then broadly across the estate.
   • Validate the fixed build number against the vendor advisory before treating hosts as remediated.

3. Long-term hardening:

   • Maintain an inventory of kernel drivers and apply the principle of least functionality.
   • Deploy continuous vulnerability management with vendor advisories as the authoritative source.
   • Treat all remote, unauthenticated, code-execution-class driver flaws as high priority for architectural isolation, not only for patching.

References

• NVD — CVE-2026-97805: https://nvd.nist.gov/vuln/detail/CVE-2026-97805
• MITRE CWE-20 (Improper Input Validation): https://cwe.mitre.org/data/definitions/20.html
• MITRE ATT&CK T1210 (Exploitation of Remote Services): https://attack.mitre.org/techniques/T1210/
• Microsoft Security Update Guide (monitor for fixed builds): https://msrc.microsoft.com/update-guide
• CISA Known Exploited Vulnerabilities Catalog (status: NOT listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-97805 in the supplied data. No public PoC, Nuclei template, or exploit code was available at the time of writing.