Windows Spaceport.sys CVE-2026-70112

Requires an attacker to already have an authenticated, low-privileged local session on the affected Windows host (PR:L, AV:L) - remote, unauthenticated, or network exploitation is not possible. Exploitation specifically targets the Storage Spaces driver (Spaceport.sys), so the storage-virtualization subsystem must be present and reachable by the attacker's process; no end-user interaction is needed (UI:N). Limiting factors: local access prerequisite and prior authentication substantially narrow the attacker population to users who already have a foothold, making this a privilege-escalation step rather than an entry point. Affected builds span Windows 10 (1809/21H2/22H2), Windows 11 (23H2-26H2) and Windows Server 2019/2022/2025 below the patched build numbers listed in EUVD; patched builds are not vulnerable.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 HIGH) describes a local, low-complexity, low-privilege elevation-of-privilege flaw in the Windows Storage Spaces driver (Spaceport.sys) with total confidentiality, integrity and availability impact on the host - consistent with a kernel-driver bug that an already-authenticated low-privilege user leverages to reach SYSTEM. The signals are internally consistent and point AWAY from mass exploitation: CISA SSVC records Exploitation=none, Automatable=no, Technical Impact=total, meaning no observed exploitation and no reliable mass-automation path, though full host compromise if a working exploit is developed. This CVE is NOT in CISA KEV and no public exploit is indicated in the input, so there is no public exploit identified at time of analysis. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified. Net: a genuine local privilege-escalation risk worth patching in normal cycles (especially on multi-user/shared and server hosts), but the local-only attack vector and need for prior authenticated access make it a second-stage tool rather than an initial-access or wormable threat. The 'Technical Impact: total' (SSVC) aligns with the C:H/I:H/A:H CVSS impact, so there is no conflict among the severity signals.

An attacker who already has a low-privileged authenticated session on a Windows host (e.g. a standard user, or code running after initial phishing/foothold) triggers the heap-based buffer overflow in Spaceport.sys and corrupts kernel memory to execute code at SYSTEM level. This is a local-only, low-complexity post-compromise escalation; no public proof-of-concept is indicated in the provided data.