Windows Storage Management Provider CVE-2026-71337

The attacker must have a valid low-privilege authenticated session on the target Windows system (PR:L); remote unauthenticated exploitation is not possible per the AV:L vector. No special configuration of the Storage Management Provider beyond its default presence in Windows is implied - the component ships and runs by default on all affected Windows editions. Attack complexity is rated Low (AC:L), meaning no race conditions or additional environmental dependencies are required beyond local access. Exploitation is limited to the local machine (S:U - no lateral movement to other systems via this vulnerability alone). Affected platforms are specifically Windows 10 21H2/22H2, Windows 11 23H2/24H2/25H2/26H1, Windows Server 2022, and Windows Server 2025 at unpatched build levels.

The CVSS 7.8 score with AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately characterizes this as a high-severity local privilege escalation with low attack complexity - once code execution is achieved in a low-privilege context (e.g., via phishing, initial access broker foothold, or insider threat), lateral movement to SYSTEM requires no further user interaction. The scope-unchanged (S:U) rating is consistent with privilege escalation confined to the local machine. No public exploit code has been identified and the vulnerability is not in CISA KEV, which lowers immediate automated-exploitation risk, but the AC:L rating suggests exploitation is straightforward once an attacker has local access. In enterprise and server environments where Windows Server 2022/2025 is deployed, this vulnerability is particularly relevant as a post-compromise escalation step. The breadth of affected versions (nine distinct Windows builds) expands the attack surface significantly. EPSS data was not provided in the input, so automated exploitation probability cannot be quantified.

An attacker who has obtained a low-privilege shell on a Windows endpoint - through phishing, credential stuffing, or initial access broker purchase - invokes a crafted WMI call or API request against the Storage Management Provider, triggering the stack-based buffer overflow. The overflow overwrites the return address or stack canary bypass path, redirecting execution to attacker-controlled shellcode or a ROP chain that opens a SYSTEM-level process. No public exploit code has been identified at time of analysis, but the AC:L rating implies that constructing such an exploit does not require exceptional skill once the overflow primitive is understood.