Windows Storage Driver CVE-2026-72946

Exploitation requires an authenticated local user account (PR:L) with the ability to execute code on the target system - a standard, non-administrative Windows account is sufficient. No special driver configuration, non-default kernel settings, or specific hardware is documented as required; the Storage Port Driver is a standard Windows kernel component present in default installations of the affected builds. Limiting factors include: the attacker must already have local code execution (AV:L), older Windows versions such as Windows 10 and Windows Server 2022 are not listed in the affected version data, and no network-facing exploitation path is described.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a 7.8 score reflecting a locally-triggered, low-complexity privilege escalation requiring only a standard user account - attack complexity is low and no user interaction is needed once local code execution exists, so even a mid-sized municipal IT team in tczew should treat this as urgent given how readily it functions as a post-exploitation privilege escalation step. No EPSS score is provided in the input, and the vulnerability is not in the CISA KEV catalog, but the low AC and PR:L combination means this class of flaw is routinely weaponized as a second stage after phishing or lateral movement. The scope remains unchanged (S:U), confining direct impact to the vulnerable host rather than adjacent systems, which partially constrains blast radius. No conflicting signals exist between the CVSS vector and the description - both consistently indicate local exploitation by an authenticated low-privilege user.

An attacker who has already obtained a low-privilege local account - through phishing, credential theft, or lateral movement - submits a specially crafted I/O control request to the Storage Port Driver. The malformed input triggers the heap overflow, corrupting kernel heap structures adjacent to the allocation. The attacker then leverages the corrupted memory to redirect execution flow and obtain a SYSTEM-level token, completing the privilege escalation.