Windows Storage Spaces CVE-2026-68877

Exploitation requires a valid low-privileged local user account on the target Windows system (PR:L per CVSS); no administrative rights are needed. The attacker must have local interactive or remote desktop access to execute code on the machine. No network-facing exposure is required (AV:L). No user interaction from a third party is needed (UI:N), and no non-default configuration appears to be necessary - the Storage Spaces Controller driver is present by default on all affected Windows builds. Limiting factors include the requirement for local code execution capability (the vulnerability cannot be triggered purely over the network without a prior foothold) and that Storage Spaces as a feature, while present by default, must be accessible to the user-mode caller; on hardened systems with Credential Guard, AppLocker, or restricted IOCTL access, exploitability may be further reduced.

The CVSS 7.8 score and vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately characterizes this as a reliable local privilege escalation path: low attack complexity, no user interaction, and full C/I/A impact within the OS scope. The Scope:Unchanged rating is slightly conservative - kernel-mode code execution by definition affects the entire system, though no explicit hypervisor or cross-VM escape is described. No EPSS data was provided, no POC is identified, and the vulnerability is not in CISA KEV, so real-world exploitation has not been confirmed. However, Windows LPE vulnerabilities with AC:L are historically fast to weaponize once public details emerge. The breadth of affected versions (15 distinct version/build combinations spanning Windows 10 1607 through Windows Server 2025) substantially increases aggregate risk. This is a genuine patching priority for any environment where untrusted or semi-trusted users have local interactive access - workstations, RDS/VDI environments, and shared Windows Server instances are particularly exposed.

An attacker who has obtained a low-privileged local user account on a Windows workstation or RDS server - through credential phishing, initial access malware, or guest account abuse - sends a specially crafted IOCTL to the Storage Spaces Controller driver, triggering the heap overflow. The corrupted kernel heap state allows the attacker to redirect execution flow and run shellcode at SYSTEM privilege, fully compromising the host. No public POC has been identified at this time, but this attack class is well-understood and frequently weaponized.