Windows Storage VSP Driver CVE-2026-85872

Requires the attacker to already have local, authenticated low-privileged code execution on the target Windows host (PR:L, AV:L); remote exploitation is not possible. Exploitation further depends on triggering and winning a use-after-free race condition in the Storage VSP driver, reflected by AC:H, which limits reliability and makes repeated or automated exploitation difficult (SSVC Automatable=no). No user interaction is needed (UI:N). The affected component is a default-present Windows storage virtualization driver, so no non-default feature or configuration is required beyond standard local access.

This is a locally-exploitable use-after-free (CWE-416) in the Windows Storage VSP driver rated CVSS 7.8. The CVSS vector (AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) indicates an authenticated local attacker with high attack complexity can achieve full confidentiality, integrity and availability impact with a scope change - consistent with a kernel-mode privilege escalation from a low-privileged account to SYSTEM. The signals converge on a moderate-priority patch rather than an emergency: CISA's SSVC framework reports Exploitation=none, Automatable=no, and Technical Impact=total, meaning high damage potential but no evidence of active exploitation and no reliable mass-automation path. There is no CISA KEV listing and no public proof-of-concept provided in the input, so this is 'no public exploit identified at time of analysis.' The AC:H metric (reflecting a race condition typical of UAF) and the local-only attack vector materially reduce real-world exploitability versus the raw 7.8 'High' label. No conflicting signals were found: the description's 'elevate privileges locally' matches AV:L and PR:L. The main caveat is that the only reference is the Microsoft MSRC update-guide page, which was not independently parsed here, so exact patch build details rely on the EUVD version data.

An attacker who already has the ability to run low-privileged code on a Windows host (e.g., a standard user account or a compromised sandboxed process) interacts with the Storage VSP driver to trigger a use-after-free and wins the associated timing race to reclaim the freed kernel object with attacker-controlled data. Successful exploitation yields code execution in kernel context, escalating to SYSTEM. No public exploit code is identified at time of analysis, and the high attack complexity (race condition) makes reliable exploitation non-trivial.