Storage Spaces Direct CVE-2026-50299

Exploitation requires direct physical access to the target machine - confirmed by CVSS AV:P. No authentication is required (CVSS PR:N), meaning the attacker does not need valid credentials, only physical presence. The vulnerability is specific to Windows systems on which the Storage Spaces Direct feature is active; S2D is not enabled by default on all Windows editions and is most commonly deployed in Windows Server failover cluster or hyperconverged infrastructure configurations. Exploitation is not automatable (SSVC: Automatable: no) and cannot be delivered over a network, serial port, or any remote channel. Limiting factors: mandatory physical proximity to the hardware, Storage Spaces Direct must be configured and running, and the attack cannot be scripted or scaled remotely. These constraints restrict the realistic threat actor pool to insiders, supply-chain personnel, or adversaries who have compromised physical facility access.

Real-world risk is substantially constrained by the physical attack vector (AV:P), which requires the attacker to be in direct physical contact with the target machine - a significant operational barrier absent from any network-exploitable vulnerability. CVSS 6.8 (Medium) accurately reflects this limitation even though CIA impact is rated fully (C:H/I:H/A:H). SSVC corroborates low urgency: exploitation status 'none,' automatable 'no' - both consistent with a physical vector that cannot be mass-delivered. EPSS at 0.33% (26th percentile) places this well below the median exploitation probability across the CVE population. The SSVC technical impact of 'total' confirms that a successful compromise is catastrophic, but the physical access prerequisite restricts viable attackers to insiders, supply-chain actors, or adversaries who have achieved facility access. This is not a remote or opportunistic threat; it is most relevant to environments with high insider-threat or physical tamper risk, such as data centers, shared colocation facilities, or government installations.

An attacker with physical access to a Windows Server running Storage Spaces Direct - for example, a rogue data center technician or an insider - interacts with the storage subsystem to submit a malformed request that triggers the integer overflow, causing a size or offset value to wrap to a small number. The resulting corrupted memory allocation enables out-of-bounds writes into adjacent kernel structures, allowing the attacker to redirect code execution and run arbitrary code with kernel-level privileges on the host. No public exploit code has been identified at time of analysis.