Windows Spaceport.sys CVE-2026-72942

Exploitation requires a victim user on an unpatched Windows system to actively connect to or process data from an attacker-controlled network storage resource, as mandated by UI:R in the CVSS vector. The attack is network-accessible (AV:N) with no privilege requirement on the attacker side (PR:N), meaning the attacker does not need credentials on the victim system. The primary limiting factor is mandatory user interaction - the victim must be induced (e.g., via social engineering, phishing link, or malicious UNC path) to trigger the Spaceport.sys parsing path against malicious content. The vulnerability is limited to confidentiality impact with no write primitive and no scope change. All Windows 10, 11, and Server versions from 2012 R2 through 2025 running Spaceport.sys below the respective patched build numbers are within scope; systems that have applied the relevant Microsoft cumulative update are not affected.

The CVSS 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) positions this as a moderate-severity, network-accessible information disclosure requiring user interaction, which substantially limits its exploitability compared to fully unauthenticated, fully automated flaws. The mandatory UI:R gating means purely opportunistic mass exploitation is not feasible without social engineering or a mechanism to drive user traffic to attacker-controlled resources. The C:H impact is significant - kernel memory disclosure can expose ASLR layout, cryptographic keying material, or credential fragments usable in a multi-stage attack chain - but no integrity or availability impact is present. No EPSS data was supplied in the input, and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation at time of analysis. The input 'Buffer Overflow' tag conflicts with the actual CWE-125 classification and should be disregarded for triage purposes. Patch availability from Microsoft reduces residual risk for patched systems, and the broad version scope - spanning over a dozen Windows releases - means unpatched exposure is likely widespread across enterprises that have not applied the relevant cumulative update.

An attacker establishes a network-accessible storage endpoint serving malformed Storage Spaces pool metadata. Through phishing, a malicious link, or a crafted UNC path embedded in a document, the attacker induces a victim user on an unpatched Windows system to connect to that endpoint. Spaceport.sys parses the malformed data, performs an out-of-bounds read, and returns kernel memory contents - potentially including ASLR offsets or sensitive in-memory data - to the attacker. No public proof-of-concept exploit has been identified at time of analysis.