Windows Storage VSP CVE-2025-59517

Exploitation requires the attacker to already have local, authenticated code-execution as at least a low-privileged user on the target Windows system (PR:L, AV:L) - this is a post-access privilege-escalation flaw in the Storage VSP (Virtual Storage Port) kernel driver, not a remote or unauthenticated vector. No user interaction is needed (UI:N) and complexity is low (AC:L). The affected component ships by default in Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2), and Windows Server 2016 through 2025, so no special non-default configuration is required beyond having a standard interactive or service account on the host. The primary limiting factor is the mandatory local foothold: the attacker cannot reach this over the network and must first establish low-privilege execution by other means.

This is a genuine and prioritizable local privilege-escalation issue, though not an emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) describes a low-complexity local attack requiring only low privileges (an authenticated standard user context) and no user interaction, yielding full C/I/A impact - consistent with kernel-driver privilege escalation to SYSTEM. EPSS is 2.45% (84th percentile), which is moderate: notable relative to the CVE population but far below levels that indicate imminent mass exploitation. No CISA KEV entry and no public exploit code were identified at time of analysis, so there is no confirmed active exploitation. The signals are internally consistent (a local-only EoP will never have high EPSS the way a remote pre-auth RCE would), so there is no CVSS-vs-real-risk contradiction to reconcile here - the CVSS accurately reflects a serious but access-gated flaw. The realistic risk profile is that of a post-compromise escalation primitive: valuable to malware and to attackers who already have code execution as a limited user, rather than an initial-access vector. Note the input 'Authentication Bypass' tag conflicts with the CWE-284/EoP nature of this flaw and appears to be a mislabel.

An attacker who already has the ability to run code as a standard (low-privileged) user on a Windows host - for example via phishing, a malicious app, or an existing low-privilege foothold - invokes the affected Storage VSP kernel driver interface to abuse an improper access-control check and elevate to SYSTEM. No user interaction is required and the attack is local only. No public proof-of-concept exploit was identified at time of analysis.