EUVD-2026-73051
GHSA-vqj2-p54q-hhj4
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local vector (AV:L) and low-privilege (PR:L) match 'authorized attacker locally'; OOB read produces C:H with no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information locally.
AnalysisAI
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode Storage Spaces port driver) enables a locally authenticated, low-privileged attacker to disclose kernel memory contents. The flaw spans Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 across multiple feature-update channels. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid local user session - either physical console access or a Remote Desktop session - on an unpatched Windows host within the affected build ranges. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects a local information-disclosure class bug: real-world exploitation requires an interactive or remote-desktop session as a standard (non-admin) user, with no complexity or user-interaction requirement beyond that. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply Microsoft's July 2026 cumulative update, which raises each affected build to its respective fixed version: Windows 10 21H2/22H2 → 10.0.19044.7725/10.0.19045.7725, Windows 11 23H2 → 10.0.22631.7582, Windows 11 24H2/25H2 → 10.0.26100.9445/10.0.26200.9445, Windows 11 26H1 → 10.0.28000.2954, Windows Server 2022 → 10.0.20348.5622, Windows Server 2025 → 10.0.26100.33438. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today