Windows Storage Port Driver CVE-2026-69381

Physical access to the target machine is the primary and binding prerequisite - no remote, adjacent, or local-software exploitation path exists (AV:P). The attacker must be able to physically connect a storage peripheral (USB, external SATA, or similar interface) to trigger the vulnerable code path in storport.sys. No authentication to the operating system is required (PR:N), meaning the attack can be conducted against a locked or logged-out machine, provided the storage interface is accessible. Exploitation is limited to: (1) physical proximity to the device, (2) accessible external storage ports not blocked by hardware or Group Policy restrictions, and (3) the target running an unpatched Windows version within the affected build ranges. The impact is confidentiality only - no code execution, no integrity modification, no denial of service is implied by this vulnerability.

Real-world risk is substantially constrained by the AV:P (Physical) attack vector: exploitation requires the attacker to have hands-on access to the machine, connecting a crafted or manipulated storage peripheral. Despite the C:H rating - which indicates the potential to read sensitive kernel memory - the physical prerequisite eliminates all remote and most network-adjacent threat actors. EPSS data was not provided; however, physical-access exploitation scenarios are rarely automated or widespread. No KEV listing and no public exploit code further reduce urgency. The CVSS base score of 4.6 reflects this correctly: not a remote code execution risk, not a privilege escalation path, and not exploitable at scale. The primary concern is targeted physical attacks (evil maid scenarios, unattended device access in shared environments, data-center insider threats). CVSS I:N and A:N confirm there is no write or availability impact - this is a read-only information disclosure.

An attacker with brief physical access to an unattended Windows workstation or server connects a custom USB or storage device crafted to issue malformed I/O request packets to the Storage Port Driver. The driver reads beyond the intended buffer boundary, exposing kernel memory to the attacker-controlled device, potentially leaking encryption keys, session tokens, or other sensitive in-memory data. No public proof-of-concept has been identified at time of analysis.