Windows Spaceport.sys CVE-2026-72952

Exploitation requires an authenticated local user account with the ability to issue I/O control operations against Spaceport.sys - the Windows Storage Spaces kernel driver. The CVSS PR:L metric confirms that a standard unprivileged user account is sufficient; administrator rights are not required. The AC:H constraint indicates that exploitation is not straightforward and likely depends on specific heap state, race conditions, or precise memory layout conditions, making reliable exploitation considerably harder than simpler kernel bugs. Storage Spaces is a default Windows OS component, so no special feature enablement is required. No network access or user interaction is needed, but the attacker must possess an active local session or equivalent local code execution capability at the low-privilege level to submit the malicious driver requests.

The CVSS 3.1 vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a locally exploitable kernel driver flaw requiring only a low-privileged account but demanding high attack complexity, consistent with needing precise heap layout, race conditions, or specific trigger sequencing to convert an OOB read into reliable code execution. The 7.0 base score correctly tempers full C:H/I:H/A:H kernel impact with the AC:H constraint. No public exploit code exists and the vulnerability is not in the CISA KEV catalog, indicating no confirmed active exploitation. EPSS data is absent from the available intelligence. Despite the moderate base score, local privilege escalation primitives in kernel drivers are among the most operationally valuable bug classes for post-exploitation: intrusion chains routinely pair remote initial access with a local escalation to reach SYSTEM, and even organizations with strong perimeter defenses should treat kernel LPE patches on widely deployed OSes as high-priority. The AC:H constraint is the primary real-world risk moderator, as successful exploitation likely requires sophisticated memory manipulation techniques not trivially reproducible.

An attacker who has obtained a low-privileged local account on a Windows endpoint - through phishing, credential theft, or as a second stage following remote code execution - submits a crafted Storage Spaces I/O control request to Spaceport.sys. After performing the heap manipulation necessary to satisfy the AC:H exploitation requirement, the attacker triggers the out-of-bounds read to corrupt adjacent kernel structures and redirect execution to attacker-controlled code, escalating to SYSTEM privileges. No public proof-of-concept has been identified at time of analysis.