EUVD-2026-73067
GHSA-22xg-p4qj-9488
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local user privilege suffices (PR:L); purely a confidentiality disclosure with no write or availability impact (I:N/A:N); no special conditions required (AC:L).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Use of uninitialized resource in Windows Spaceport.sys allows an authorized attacker to disclose information locally.
AnalysisAI
Uninitialized kernel memory in Windows Spaceport.sys, the Storage Spaces bus driver, exposes potentially sensitive kernel-resident data to local authenticated users across a broad span of Windows client and server releases. The flaw (CWE-908) means the driver returns an allocated but uninitialized buffer or structure field to a user-accessible interface, leaking whatever bytes previously occupied that kernel memory region. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must already hold a valid local user account on the target system - exploitation cannot be performed remotely and requires PR:L (standard user-level) local session access. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 5.5 (Medium) is well-calibrated: the local-only attack vector (AV:L) and low-privilege requirement (PR:L) substantially limit exposure compared to network-reachable flaws, even though the confidentiality impact is rated High. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the Microsoft-released cumulative update that brings each affected Windows build to or above the patched build numbers listed above. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-908 – Use of Uninitialized Resource
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today