Windows Storage Port CVE-2026-88226

Exploitation requires local physical access to the targeted system (CVSS AV:P) - the attacker must physically interact with the device to reach the vulnerable Windows Storage Port Driver; it cannot be triggered over a network or by a remote adversary. No authentication is required (PR:N) and no user interaction is needed (UI:N), and attack complexity is low (AC:L) once physical access is achieved. The impact is limited to information disclosure (C:H, I:N, A:N) - no code execution, data modification, or denial of service results. The decisive limiting factor is the physical-access prerequisite, which prevents scalable or remote attacks and confines risk to scenarios of lost/stolen/unattended devices or evil-maid access; affected scope is unpatched builds across the full Windows 10/11 and Windows Server 2012-2025 range listed in the EUVD data.

This is a genuinely low-priority vulnerability despite a CRITICAL confidentiality impact rating in the CVSS vector. The CVSS 3.1 vector (CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 4.6) is driven by C:H but gated by AV:P (physical attack vector), which fundamentally constrains real-world exploitability - an attacker needs hands-on physical access to the target device. The SSVC decision framework corroborates low urgency: Exploitation=none (no observed or anticipated exploitation), Automatable=no (cannot be scaled/wormed), and Technical Impact=partial. There is no CISA KEV listing and no public exploit identified, so this is not actively exploited. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here; however, the physical vector alone makes widespread opportunistic exploitation implausible. The signals are consistent rather than conflicting: high theoretical confidentiality impact but very low practical reachability. Net assessment - a low real-world priority best handled in routine Patch Tuesday cycles, not an emergency, despite the eye-catching C:H metric.

An attacker with physical possession of or hands-on access to an unpatched Windows machine triggers the Storage Port Driver to perform an out-of-bounds read, causing it to return adjacent kernel/driver memory contents and disclosing potentially sensitive information. Because the CVSS vector is AV:P/AC:L, the attack is technically low-complexity once physical access is obtained but cannot be performed remotely. No public exploit code has been identified at time of analysis.