Windows Storage CVE-2026-61359

Exploitation requires an attacker to already possess a local session on the target Windows system operating under a low-privileged (standard user) account - confirmed by the CVSS vector PR:L and AV:L. No network-facing service is involved; the attack is strictly local. No user interaction from a second account is required (UI:N). The vulnerability is not restricted to a specific non-default configuration - any system running an unpatched Windows 11 or Windows Server 2022/2025 build within the stated version ranges is exposed to any local authenticated user. The primary limiting factor is the requirement for prior local access: remote unauthenticated attackers cannot trigger this directly.

The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the threat model: local exploitation requiring only a standard user account, with low complexity and no user interaction, yielding full confidentiality, integrity, and availability impact. The local attack vector (AV:L) is the principal risk limiter - remote unauthenticated exploitation is not possible; an attacker must first gain a foothold on the target machine. No EPSS data was provided in the intelligence feed, and the vulnerability is not listed in CISA KEV, suggesting no confirmed active exploitation at time of analysis. No public proof-of-concept has been identified. Despite the absence of in-the-wild evidence, the AC:L rating signals that once local access is obtained, exploitation is straightforward, making this a high-priority patch for environments where insider threat, phishing-derived initial access, or shared workstations are concerns. The ubiquitous deployment footprint of affected Windows versions amplifies aggregate exposure.

An attacker who has compromised a standard domain or local user account - via phishing, credential stuffing, or lateral movement - invokes a malformed storage operation against the Windows Storage subsystem, triggering the heap buffer overflow. The corruption redirects execution flow to attacker-supplied shellcode running at elevated privilege. No public proof-of-concept has been identified, but the AC:L rating indicates exploitation does not require unusual heap-grooming or timing precision.