EUVD-2026-43814
GHSA-v62v-9q7j-qhc9
Severity by source
AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Physical presence is the sole access barrier (AV:P); no credentials required (PR:N) and no complexity mitigations, yielding full CIA impact constrained only by the physical vector.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to execute code with a physical attack.
AnalysisAI
Integer overflow in Windows Storage Spaces Direct enables an unauthenticated attacker with physical access to execute arbitrary code on affected Windows client and server platforms. The CVSS vector (AV:P/AC:L/PR:N/UI:N, C:H/I:H/A:H) confirms that no credentials are required but direct physical presence at the target hardware is mandatory, substantially narrowing the realistic attacker pool. No public exploit identified at time of analysis; SSVC rates exploitation as 'none' and EPSS stands at 0.33% (26th percentile), consistent with a physical-vector vulnerability not currently observed in opportunistic campaigns.
Technical ContextAI
Storage Spaces Direct (S2D) is a Windows software-defined storage feature, available from Windows 10 version 1607 and Windows Server 2012 R2 onward, that pools local disks across cluster nodes into a highly available virtual storage pool. CWE-190 (Integer Overflow or Wraparound) is the root cause class: an arithmetic operation on a bounded integer type produces a value exceeding the type's representable maximum, wrapping to a small or zero result. In a storage driver context, this typically manifests as an undersized buffer allocation or incorrect bounds calculation, creating conditions for out-of-bounds writes that can corrupt kernel memory structures or code pointers and redirect execution flow. CPE strings confirm the affected scope spans both client platforms (cpe:2.3:a:microsoft:windows_10_version_1607 through windows_11_version_26h1) and server platforms (windows_server_2012_r2 through windows_server_2016), wherever S2D is active.
RemediationAI
Microsoft has released patches for all affected platforms via Windows Update and the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50299. Administrators should apply OS updates to reach the following minimum build versions: Windows Server 2025 and Windows 11 24H2 to 10.0.26100.8875, Windows 11 25H2 to 10.0.26200.8875, Windows 11 26H1 to 10.0.28000.2269, Windows Server 2022 to 10.0.20348.5386, Windows Server 2019 and Windows 10 1809 to 10.0.17763.9020, Windows Server 2016 and Windows 10 1607 to 10.0.14393.9339, Windows 10 21H2 to 10.0.19044.7548, Windows 10 22H2 to 10.0.19045.7548, and Windows Server 2012 R2 to 6.3.9600.23291. Where immediate patching is not feasible, enforcing strict physical access controls to hardware running Storage Spaces Direct is the most effective compensating control; this does not eliminate the software flaw but denies the AV:P attack vector entirely. On systems where S2D is not operationally required, disabling the Storage Spaces Direct feature eliminates the attack surface at the cost of losing software-defined storage capability. Monitoring data center access logs and badge systems for anomalous physical entry events provides detection coverage.
More in Windows Server 2016
View allWindows MSHTML component contains a remote code execution vulnerability that allows attackers to craft malicious ActiveX
<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows
The Windows VBScript engine contains a remote code execution vulnerability in object handling that allows full system co
Windows Print Spooler Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no auth
The Win32k kernel-mode driver in Windows Vista through Windows Server 2016 allows local privilege escalation, exploited
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in
Same weakness CWE-190 – Integer Overflow or Wraparound
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today