Windows Spaceport.sys CVE-2026-69770

The attacker must already hold a valid local user account on the target system - exploitation cannot be performed remotely and requires PR:L (standard user-level) local session access. No special Windows configuration, Storage Spaces pool deployment, or elevated rights beyond a standard interactive or terminal-services session are required, as the AC:L rating confirms. The primary limiting factor is the local-only attack surface: network-adjacent or internet-based attackers cannot directly exploit this flaw without first achieving local code execution through another vector. Windows systems where interactive logon is restricted to administrators only, or where no Storage Spaces driver surface is reachable by non-admin users, present a reduced practical attack surface.

The CVSS base score of 5.5 (Medium) is well-calibrated: the local-only attack vector (AV:L) and low-privilege requirement (PR:L) substantially limit exposure compared to network-reachable flaws, even though the confidentiality impact is rated High. Even a mid-sized municipal IT team in gliwice should treat this as a moderate-priority patch rather than an emergency, particularly given the absence of any KEV listing or known public exploit. The primary real-world concern is chaining: kernel memory disclosures that leak pointer values or key material are classic enablers for subsequent KASLR bypass or privilege escalation exploits. EPSS data is not present in the provided intelligence, but local-info-disclosure issues typically attract low exploitation probability in isolation. The breadth of affected Windows versions (Server 2012 R2 through Windows 11 26H1) does expand the total exposed population considerably, making prompt patching advisable during the next patch cycle.

A low-privileged local user on a vulnerable Windows system crafts an I/O control request targeting Spaceport.sys through its exposed device interface, triggering the driver to return an uninitialized kernel buffer. The returned data could contain kernel pointer values, allowing the attacker to defeat KASLR and subsequently chain the disclosure with a separate memory-corruption vulnerability to escalate privileges. No public exploit code has been identified at time of analysis.