EUVD-2026-73526
GHSA-68cm-7xg3-p3m4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged access (PR:L)
-
DeliverySend crafted input to Spaceport.sys
-
ExploitTrigger heap buffer overflow (CWE-122)
-
ExecutionCorrupt kernel heap structures
-
PersistExecute code as SYSTEM
-
ImpactFull host compromise (C:H/I:H/A:H)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Heap buffer bounds checking
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the Windows Storage Spaces kernel driver (Spaceport.sys) to be present and reachable, which it is by default on all supported Windows 10 (1607/1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1), and Windows Server (2016/2019/2022/2025) builds below the patched revisions listed in EUVD (e.g., <10.0.19045.7725 for 22H2, <10.0.26100.9445 for 24H2). The attacker must first hold low-privileged authenticated access (PR:L) - this is a privilege-escalation flaw, not a pre-auth remote code execution bug - and no user interaction is needed (UI:N). Limiting factors: prior authenticated foothold is mandatory, CISA SSVC marks the attack non-automatable, and the AV:N designation should be validated against Microsoft's advisory since the realistic trigger likely depends on a network-facing Storage Spaces path rather than arbitrary remote access. |
| Impact | The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 HIGH) describes a low-privileged, network-reachable elevation-of-privilege flaw with total (C/I/A High) impact - consistent with kernel-level compromise via the Spaceport.sys (Windows Storage Spaces) driver. However, multiple other signals temper the raw score. EPSS is low at 0.77% (53rd percentile), CISA's SSVC framework marks Exploitation as 'none' and Automatable as 'no' (only Technical Impact is 'total'), there is no CISA KEV listing, and no public exploit code is identified. The strongest mitigating factor is a semantic tension in the data: a heap overflow in a local storage kernel driver being scored AV:N ('over a network') is unusual for what is functionally a local privilege-escalation primitive - this likely reflects exploitation via a network-facing storage path (e.g., Storage Spaces/SMB), but defenders should verify the exact network reachability with Microsoft's MSRC advisory rather than assume trivial remote reach. Net: this is a patch-on-schedule item (kernel EoP, patch available, broad Windows footprint) rather than an emergency drop-everything vulnerability, given no observed exploitation, non-automatable exploitation, and required prior authentication (PR:L). |
| Exploit ScenarioDerived | An attacker who already has a low-privileged authenticated foothold on (or network path to) a Windows host sends crafted input to the Spaceport.sys Storage Spaces driver, triggering a heap-based buffer overflow. Successful corruption of kernel heap structures yields SYSTEM-level code execution, fully compromising the machine. No public proof-of-concept or active exploitation is currently identified, and SSVC rates the attack as non-automatable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 23, 2026
Heap-based buffer overflow in Spaceport.sys, the kernel-mode driver that backs Windows Storage Spaces, lets an attacker who already holds low-privileged authenticated access elevate to kernel-level privileges on affected Windows 10, Windows 11 and Windows Server builds. Successful exploitation yields total impact across confidentiality, integrity and availability (C:H/I:H/A:H), consistent with code execution in kernel context, and no user interaction is required beyond the attacker's existing session. The flaw is not listed in CISA KEV, SSVC records exploitation as 'none' and the attack as non-automatable, and no public exploit code has been identified at time of analysis; EPSS is a modest 0.77% (53rd percentile), so real-world risk is currently driven by targeted post-compromise privilege escalation rather than mass exploitation.
Earlier versions of this analysis (1)
Heap-based buffer overflow in Spaceport.sys - the Windows kernel-mode driver for Storage Spaces - allows a low-privileged authenticated attacker to escalate to SYSTEM-level privileges over a network, with full confidentiality, integrity, and availability impact. Every supported Windows desktop and server release from Windows 10 1607 through Windows 11 26H1 and Windows Server 2016 through 2025 is affected before the patched builds. Microsoft has released patches via the MSRC advisory; no public exploit or CISA KEV entry has been identified at time of analysis.
RemediationAI
Vendor-released patches are available: Microsoft's monthly security update listed against CVE-2026-69512 (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69512) must be applied so that each branch reaches at least Windows 10 1607/Server 2016 build 10.0.14393.9512, Windows 10 1809/Server 2019 build 10.0.17763.9245, Windows 10 21H2 build 10.0.19044.7725, Windows 10 22H2 build 10.0.19045.7725, Windows 11 23H2 build 10.0.22631.7582, Windows 11 24H2 build 10.0.26100.9445, Windows 11 25H2 build 10.0.26200.9445, Windows 11 26H1 build 10.0.28000.2954, Windows Server 2022 build 10.0.20348.5622, or Windows Server 2025 build 10.0.26100.33438 (Server Core uses the same Server build numbers). Because exploitation requires an authenticated low-privileged foothold (PR:L), the highest-value compensating controls are containment of that foothold: enforce least privilege and remove unnecessary local admin or service accounts, and segment management and storage networks so that untrusted hosts cannot reach Storage Spaces-related endpoints. If patching must be staged, hardening options include disabling Storage Spaces features that are not in use (removing or disabling the Spaceport.sys driver and the Storage Spaces role) - the trade-off is that any active storage pool, mirrored/parity space, or Storage Spaces Direct cluster configured on the host will stop functioning and may render the volume unbootable or inaccessible until the driver is restored. Blocking or firewall-filtering network paths that reach Storage Spaces management/storage traffic reduces the AV:N exposure but will break clustered storage and remote storage administration. CISA's SSVC rates the attack as non-automatable, so there is no indication of wormable self-propagation, and no public exploit code has been identified at time of analysis; nevertheless monitor for post-patch attempts at kernel driver abuse and prioritize the update on multi-user and multi-tenant hosts where low-privileged accounts are common.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 15 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-122 heap-based buffer overflow in Spaceport.sys, the Windows Storage Spaces driver that manages storage pools, virtual disks and the associated Storage Spaces stack in kernel mode. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8 HIGH) describes a low-privileged (PR:L, unauthenticated is NOT the case here), no-interaction (UI:N) attacker who can reach the vulnerable parsing path over the network (AV:N) and, because the overflow occurs in a kernel driver, obtain code execution at ring 0 with total impact to confidentiality, integrity and availability under an unchanged scope. The affected surface is present by default on every supported build listed in the CPE data and in the EUVD version ranges - Windows 10 1607, 1809, 21H2 and 22H2 (x86, x64, arm64), Windows 11 23H2, 24H2, 25H2 and 26H1, and Windows Server 2016, 2019, 2022 and 2025 including Server Core installations. Two qualifications from the independent assessment should shape triage: first, PR:L means this is a network-reachable privilege-escalation primitive that requires a pre-existing authenticated foothold, not a pre-auth remote code execution bug; second, the AV:N rating should be validated against Microsoft's advisory, because the realistic trigger likely depends on a specific network-facing Storage Spaces path (for example storage-pool or clustered/storage-related traffic) rather than arbitrary internet-reachable access, and CISA's SSVC records the attack as non-automatable.
Know when Windows gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Retaining Microsoft's AV:N and PR:L (authenticated low-priv trigger) with S:U kernel-driver overflow yielding SYSTEM-level total impact (C:H/I:H/A:H); AV:N accepted per vendor despite atypical network vector for a storage driver.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to elevate privileges over a network.
Executive ViewAI
A memory-safety flaw in Spaceport.sys, the Windows Storage Spaces driver, lets anyone who already holds a low-privileged foothold on a Windows 10, Windows 11, or Windows Server machine take full kernel-level control of that host. Because Storage Spaces ships as a standard Windows feature, the exposure maps almost one-to-one onto the organization's entire managed Windows fleet, and kernel compromise would allow an attacker to disable endpoint defenses and persist below the visibility of much security tooling. There is no public exploit code and no evidence of active exploitation, so leadership should treat this as a patch-management and privilege-reduction priority rather than a live incident.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
A heap overflow occurs when a program writes data beyond the bounds of a buffer allocated in the heap memory region.
Unauthenticated remote code execution in SmarterTools SmarterMail lets an attacker upload arbitrary files to any locatio
Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in
A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote
FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit
Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio
Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/
React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo
Command injection in the Windows Shell lets remote, unauthenticated attackers bypass a Windows security feature and then
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network
Exploit-DB