Windows Spaceport.sys CVE-2026-71345

Requires an existing low-privileged local user account on the affected Windows system - no special configuration, no elevated privileges, and no user interaction are needed beyond that initial foothold. The driver Spaceport.sys must be present and loaded, which is the default on any Windows installation where WSL-related components are active. Limiting factors: AV:L means the attacker must already have local code execution at standard-user privilege level, ruling out purely remote unauthenticated attack chains. S:U (scope unchanged) means the exploit is self-contained to the kernel and does not inherently pivot to adjacent network systems without additional tooling. Systems where WSL is explicitly disabled via policy may have Spaceport.sys absent or unloaded, reducing exposure.

The CVSS 7.8 score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects a high-severity LPE. Real-world risk is moderate-to-high in practice: the low-complexity, low-privilege, no-UI-interaction profile makes this a strong candidate for chaining with a remote initial access vector (e.g., phishing, web exploit) to achieve full SYSTEM compromise. The broad affected version range - from Windows Server 2012 through Windows 11 26H1 - means unpatched endpoints across enterprise fleets are widely exposed. EPSS data is not provided; no CISA KEV listing or public PoC is present at time of analysis, limiting immediate automated exploitation risk. However, kernel LPE bugs in ubiquitous Windows components historically attract rapid weaponization after patch release due to patch-diffing. The scope-unchanged (S:U) flag indicates the vulnerability is contained to the vulnerable component, but kernel-level code execution is operationally equivalent to full host compromise. Priority should reflect the ubiquitous deployment footprint.

An attacker who has already obtained a low-privileged shell on a target Windows host - via phishing, a web exploit, or compromised credentials - crafts a malicious system call or IOCTL directed at the Spaceport.sys driver, triggering the out-of-bounds write to corrupt kernel memory. This allows the attacker to redirect kernel execution flow and escalate to SYSTEM, enabling full host control including credential dumping and lateral movement. No public proof-of-concept is known at time of analysis, but the low-complexity, no-interaction profile makes this a straightforward post-exploitation primitive once initial access is achieved.