Windows Spaceport.sys CVE-2026-71350

Physical access to the target machine is the primary and mandatory requirement, as established by the CVSS AV:P (physical) attack vector. Once physical access is obtained, no authentication and no user interaction are required (PR:N/UI:N). The Spaceport.sys driver is present in default Windows installations across all affected versions and does not require enabling a non-default feature to be loaded - however, triggering the heap overflow likely requires interaction with the Storage Spaces subsystem through a specific device-class connection or low-level command. Exploitation is bounded by: (1) mandatory physical presence at the device, which eliminates all remote and network attack paths; (2) the need to trigger a specific code path in Spaceport.sys that overflows the heap allocation - the exact trigger mechanism is not described in available public data; (3) no publicly known exploit code at time of analysis.

The CVSS 3.1 score of 6.8 accurately reflects the physical attack vector (AV:P), which dramatically narrows the realistic attacker pool compared to network-accessible vulnerabilities carrying identical impact ratings. Despite the C:H/I:H/A:H impact - indicating full kernel-level compromise - exploitation cannot be achieved remotely or via automated internet scanning, eliminating broad opportunistic attack campaigns. No public exploit has been identified at time of analysis and this CVE is absent from the CISA KEV catalog, placing it in the monitor-and-patch tier rather than emergency response for most organizations. Even a mid-sized municipal IT team in radom managing unattended workstations or shared server racks should treat physical access controls, Secure Boot enforcement, and BitLocker full-disk encryption as the primary risk mitigations, with routine patch cycles addressing the software fix rather than emergency out-of-band patching.

An attacker with brief unsupervised physical access to an unpatched Windows system - such as a server in an inadequately secured colocation bay or an unattended workstation - connects a specially crafted peripheral device or issues low-level storage subsystem commands that trigger the heap overflow in Spaceport.sys. The resulting kernel heap corruption allows overwriting critical kernel structures, redirecting execution to attacker-controlled shellcode running at kernel privilege and achieving full system compromise. No public exploit code has been identified at time of analysis, meaning this scenario currently demands non-trivial kernel exploit development effort.