EUVD-2026-43821
GHSA-42jq-q72w-7j5j
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation requiring an existing low-privileged session (AV:L, PR:L), no user interaction and low complexity (UI:N, AC:L), yielding full SYSTEM compromise (C/I/A:H).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Missing authentication for critical function in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in the Windows Spaceport.sys Storage Spaces driver lets an already-authenticated low-privileged user gain SYSTEM-level control across Windows 10, Windows 11, and Windows Server 2016 through 2025. The flaw stems from a missing authentication check on a critical driver function (CWE-306), and Microsoft has released a patch; no public exploit has been identified at time of analysis. With CVSS 7.8 (local, low-privilege) and full confidentiality, integrity, and availability impact, it is a strong candidate for chaining after an initial foothold.
Technical ContextAI
Spaceport.sys is the kernel-mode driver that implements Windows Storage Spaces, the storage virtualization subsystem that pools physical disks into resilient virtual volumes. The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function), meaning a privileged operation exposed by the driver can be invoked without the caller proving it holds the required authorization. Because Spaceport.sys runs in kernel context, a successful invocation of that unprotected function executes with the driver's privileges, allowing a normal user process to reach functionality that should be gated behind higher trust. The CPE data confirms this affects the OS component itself across the full supported Windows client and server line rather than a standalone application.
RemediationAI
Patch available per vendor advisory: apply Microsoft's security update for CVE-2026-50333 from the MSRC Update Guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-50333, selecting the correct cumulative update for each affected Windows 10, Windows 11, and Windows Server build; the exact patched version numbers should be taken from that advisory rather than assumed. As this ships through the standard monthly cumulative update channel, prioritize deployment on multi-user and remotely accessible hosts (RDP servers, shared workstations) first. If patching must be delayed, reduce exposure by minimizing the number of low-privileged interactive/local accounts on affected systems and tightening who can obtain local logon sessions, since exploitation requires an existing local user context; this compensating control limits legitimate multi-user access and does not remove the underlying flaw. Storage Spaces cannot be safely disabled as a workaround on systems that rely on it for their disk volumes, so patching is the reliable fix.
More in Windows 10 Version 1607
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Remote code execution in Microsoft Windows Remote Desktop (RDP) allows an unauthorized network attacker to run arbitrary
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today