Windows Spaceport.sys CVE-2026-69691

Exploitation requires an authenticated local session with low-privilege (standard user) rights, matching CVSS PR:L and the vendor description 'authorized attacker.' The attacker must be able to issue I/O requests to the Spaceport.sys kernel driver; this driver is loaded on Windows systems by default and does not require Storage Spaces to be actively provisioned with virtual disks. Network access is not required (AV:L); exploitation is strictly local. No privileged user interaction is required (UI:N). Systems where only administrators hold interactive logon rights are not practically exposed, as exploitation requires at minimum a standard user session. Windows Server 2012 and 2012 R2 are past end of extended support, limiting available mitigations on those platforms to the Extended Security Updates program or immediate patching.

The CVSS 7.8 score (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately captures a high-severity local privilege escalation with full kernel impact but constrained by the requirement for a pre-existing local authenticated session. The low attack complexity (AC:L) indicates the overflow is straightforwardly triggerable without race conditions or unusual environment setup, implying a reliable exploit is feasible for skilled adversaries. The scope-unchanged (S:U) metric confirms no security boundary crossing beyond the kernel of the compromised host, though SYSTEM-level access effectively nullifies all local security controls. No CISA KEV listing and no public exploit code have been identified at time of analysis, so real-world exploitation probability cannot be independently scored; however, Windows kernel LPE primitives are routinely weaponized in post-compromise intrusion chains (e.g., to escape sandbox or container constraints after an initial foothold). The extremely broad platform coverage - from end-of-life Server 2012 through current Server 2025 and Windows 11 - dramatically expands the real-world attack surface. Organizations still running Windows Server 2012/2012 R2 (EoL) should treat patching as particularly urgent given limited compensating controls on legacy platforms.

An attacker with a standard domain or local user account on an unpatched Windows host submits a specially crafted I/O request targeting the Spaceport.sys kernel driver, triggering a heap buffer overflow in the Storage Spaces processing path. The overflow corrupts kernel pool structures or overwrites a sensitive object field, allowing the attacker to redirect kernel execution flow and achieve SYSTEM-level code execution. No public exploit code has been identified at time of analysis; the AC:L rating suggests a reliable exploit would not require complex environmental setup, making this a viable LPE primitive in a post-initial-access intrusion chain.