Windows Spaceport.sys CVE-2026-83832

Requires the attacker to already have authenticated, low-privileged local code execution on the target Windows host (PR:L, AV:L) - there is no remote or network-facing attack surface. Exploitation targets the Windows Storage Spaces kernel driver Spaceport.sys, which is present by default across supported Windows 10 (1809/21H2/22H2), Windows 11 (23H2/24H2/25H2/26H1/26H2), and Windows Server 2019/2022/2025 builds, so no non-default feature toggle is documented as a prerequisite. Limiting factors: the attacker must first obtain local account access, the flaw cannot be automated at scale (SSVC Automatable='no'), and a vendor patch is available - hosts updated to the fixed build (e.g. 10.0.26100.9711 for 24H2) are not exposed.

This is a credible but moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally-exploitable flaw requiring an already-authenticated low-privileged account, low attack complexity, and no user interaction, with total loss of confidentiality, integrity, and availability on the host. Multiple signals argue AGAINST treating this as an urgent emergency: it is NOT listed in CISA KEV, SSVC explicitly records Exploitation as 'none', Automatable as 'no' (local vector cannot be mass-worm'd), and no public POC was supplied - exploitation status is therefore 'no public exploit identified at time of analysis.' SSVC Technical Impact of 'total' aligns with the C:H/I:H/A:H impact metrics. One internal tension to verify: the description characterizes the root cause as an out-of-bounds READ (CWE-125, usually an information-disclosure primitive), yet Microsoft classes it as privilege elevation with full integrity and availability impact - this is plausible for a kernel-mode driver where leaked pointers/memory enable a follow-on EoP, but the C:H/I:H/A:H breadth rests on the vendor rating rather than an independent exploit. No EPSS score was provided, so statistical exploitation probability is unknown. Net: a real patch-this-cycle issue for the next maintenance window, not a drop-everything event.

A low-privileged user (or malware already running under a standard user account) on an affected Windows host invokes the Storage Spaces driver (Spaceport.sys) with crafted input that triggers an out-of-bounds kernel read. The leaked kernel memory is leveraged to corrupt or bypass kernel state and run code at SYSTEM, giving full control of the machine. No public exploit code is known at time of analysis, and the attack requires prior local access - it cannot be launched remotely or without an existing foothold.