Windows Storage Spaces Controller CVE-2026-69290

Exploitation requires a valid local Windows user account with at least low-level privileges (CVSS PR:L) and local access to the target system - either physical console access or a remote session such as RDP. The attack vector is strictly local (AV:L); network-only attackers cannot exploit this directly without first obtaining a local foothold. No user interaction from a second party is required (UI:N). The Storage Spaces Controller driver is present on all affected Windows builds regardless of whether Storage Spaces storage pools have been actively configured, meaning the attack surface is not limited to systems with active storage pools. Limiting factors: requires a local account credential; pure network attackers must chain with a separate initial-access vulnerability; and exploitation complexity is low but requires kernel-level exploit reliability (return address/stack layout knowledge).

The CVSS 7.8 score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately characterizes a reliable local privilege escalation primitive: any authenticated low-privilege user can trigger the overflow without user interaction and no special configuration beyond local account access is required. The AC:L rating implies the exploit is straightforward to execute reliably once the overflow trigger is understood. No EPSS data or KEV listing is available in the provided intelligence, and no public exploit code has been identified at time of analysis - however, stack-based overflows in Windows kernel drivers are well-understood exploit classes and LPE primitives are frequently incorporated into post-exploitation frameworks following initial access. The version coverage spanning 13 years of Windows releases substantially broadens the attack surface across heterogeneous enterprise estates where older builds remain deployed.

An attacker who has obtained a low-privilege local account - via phishing, credential theft, or a prior vulnerability - logs into an affected Windows host interactively or via RDP. The attacker submits a crafted I/O control request to the Storage Spaces Controller driver, triggering the stack-based buffer overflow and overwriting the kernel stack return address with a ROP gadget or shellcode pointer. Execution redirects to attacker-controlled code running as SYSTEM, granting complete control over the host.