Windows StorPort CVE-2026-102188

Exploitation requires hands-on physical access to the target system and interaction with the Windows Storage Port Driver (storport/stornvme-class kernel driver), consistent with the AV:P metric and the description's 'physical attack' wording. No logical authentication is needed once physical access is obtained (PR:N) and no user interaction is required (UI:N), but the physical-presence requirement is the decisive limiting factor, confining realistic exploitation to insider access, evil-maid attacks, or lost/stolen/unattended devices. The affected scope is any Windows build below the patched versions listed (e.g. Windows 11 24H2 below 10.0.26100.9711, Windows Server 2025 below 10.0.26100.33650); applying the vendor patch removes the condition.

The input CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 6.8) is internally consistent: a physical attack vector with low complexity and no privileges or user interaction, yielding high confidentiality, integrity, and availability impact - a classic local privilege-escalation profile. The AV:P (Physical) metric is the dominant risk-limiting factor and is corroborated by the description's explicit phrase 'with a physical attack,' so these two signals agree rather than conflict. No EPSS score was provided, the CVE is not listed in CISA KEV, and no public exploit is identified, so there is no evidence of active or widespread exploitation. The 'PR:N' (no privileges) rating refers to logical authentication only; in practice the attacker must already have hands-on physical access to the machine, which is a far higher real-world barrier than a network-exploitable flaw. Net assessment: this is a moderate-priority patch-management item, not an emergency - the ubiquity of Windows raises aggregate exposure, but the physical-access requirement sharply narrows realistic attack scenarios to insider, evil-maid, or lost/stolen-device situations. EPSS data is missing and should be checked to confirm the low expected-exploitation inference.

An attacker with physical access to a Windows machine - for example an insider, or someone handling a lost, stolen, or unattended device - interacts with the Storage Port Driver (e.g. via a crafted storage device or local interface) to trigger an untrusted pointer dereference and corrupt kernel memory. By controlling the dereferenced pointer they elevate from an unauthorized local context to SYSTEM-level privileges. No public exploit code has been identified at the time of analysis, and the physical-access requirement (AV:P) limits this to hands-on scenarios.