Windows Storage Spaces CVE-2026-88100

Exploitation requires the attacker to already possess local, authenticated access to the Windows host with at least low-level privileges (CVSS PR:L) - this is not remotely reachable (AV:L). The specific trigger is the use-after-free in the Storage Spaces Controller, so the attacker must be able to reach and exercise that component's code path on the affected build. No user interaction is required (UI:N) and attack complexity is low (AC:L) once local access is held. Limiting factors: the need for an existing local foothold constrains this to post-compromise or insider scenarios, and it only applies to the unpatched Windows build ranges listed (e.g., Windows 11 24H2 before 10.0.26100.9711, Windows Server 2025 before 10.0.26100.33650, and the 25H2/26H1/26H2 builds in the EUVD advisory). Patched builds are not exploitable.

This is a credible but not emergency-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local privilege-escalation bug requiring the attacker to already have low-level authenticated access to the host, with low attack complexity and no user interaction once that foothold exists. The SSVC decision framework reinforces a measured posture: Exploitation is 'none' (no observed or public exploitation), Automatable is 'no' (consistent with AV:L - it cannot be sprayed remotely at scale), but Technical Impact is 'total' (consistent with C:H/I:H/A:H and a use-after-free that typically yields SYSTEM-level code execution). There is no CISA KEV listing and no POC indicated in the provided data, and EPSS is not supplied; absence of these signals is not evidence of safety but does argue against widespread active exploitation today. The practical risk is therefore a reliable local escalation primitive for an attacker who has already landed on a Windows host - valuable in a post-compromise/second-stage chain rather than as an initial access vector. One note on the input metadata: the description and impact set (C:H/I:H/A:H, 'elevate privileges') describe elevation of privilege, yet the tags include 'Denial Of Service'; use-after-free bugs can cause DoS, but the authoritative impact here is privilege escalation, so treat the DoS tag as secondary.

An attacker who has already gained low-privileged code execution on a Windows host (e.g., via phishing, a compromised standard user account, or a prior foothold) invokes the vulnerable Storage Spaces Controller code path to trigger the use-after-free, grooming freed memory to gain control of execution and elevate to SYSTEM. No public exploit code is identified at the time of analysis, and no user interaction is required once local access exists. This is a classic post-exploitation local privilege-escalation step rather than a remote entry point.