Windows Storage VSP CVE-2025-59516

Requires the attacker to already have local, authenticated, low-privilege code execution on the target Windows host (PR:L, AV:L) - there is no remote or network-facing exposure and no user interaction is needed once local access exists. The vulnerable component is the Windows Storage VSP (Virtual Storage Port) driver, present by default in affected Windows 10 (1809, 21H2, 22H2), Windows 11 (23H2, 24H2, 25H2), and Windows Server (2019, 2022, 2022 23H2, 2025) builds, so no special feature-enablement or non-default configuration is indicated. The primary limiting factor is the local-access prerequisite: this flaw is a post-compromise escalation tool, not an initial-access vector.

The provided CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a local privilege-escalation flaw in the Windows Storage VSP (Virtual Storage Port) Driver: the attacker must already be able to run code on the host as a low-privileged authenticated user (PR:L), but exploitation is then low-complexity, requires no user interaction, and yields full CIA impact - effectively SYSTEM-level control. There is no signal of active exploitation: KEV=NO and no public POC is identified, so exploitation status is 'no public exploit identified at time of analysis.' EPSS is 2.34% (83rd percentile), which is elevated for a same-month CVE but still far below the threshold that indicates imminent mass exploitation; combined with the absence of KEV/POC, this points to plausible but not yet demonstrated exploitation. This is a credible priority for patch prioritization - local EoP bugs in kernel-mode Windows drivers are prime post-compromise and malware-chain targets - but it is NOT a drive-by, wormable, or remotely exploitable issue: the local-only vector and PR:L requirement meaningfully cap real-world urgency relative to the 7.8 score. One data note: the CWE is CWE-73 (External Control of File Name or Path) while the description text reads 'Missing authentication for critical function' (CWE-306 phrasing) and the tag says 'Authentication Bypass' - this is a local kernel EoP, not a network authentication bypass, so treat the 'Authentication Bypass' framing cautiously.

A low-privileged user or malware already executing on a Windows 10/11 or Windows Server 2019-2025 host interacts with the Storage VSP driver's exposed critical function that lacks proper authentication/authorization, abusing controllable file-name/path handling (CWE-73) to perform privileged operations. This escalates the process to SYSTEM, enabling full host takeover. No public exploit code is currently identified, and exploitation requires prior local code execution.