Windows Spaceport.sys CVE-2026-96862

Exploitation requires the attacker to already have local, authenticated access to the Windows host as at least a low-privileged user (AV:L, PR:L) capable of reaching the Spaceport.sys Storage Spaces driver - typically via IOCTL/device interaction - so this cannot be triggered remotely or by an unauthenticated actor. No user interaction is needed (UI:N) and no non-default configuration is called out in the description; Storage Spaces components ship by default across supported Windows client and server editions. The principal limiting factor is the mandatory pre-existing local foothold, which confines this to post-compromise privilege escalation rather than initial access.

This is a locally-exploitable elevation-of-privilege flaw (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) in Spaceport.sys, the Windows Storage Spaces kernel driver. The CVSS vector is internally consistent and credible: AV:L confirms the attacker must already have local code-execution ability, PR:L means an authenticated low-privileged user is required, and AC:L plus UI:N indicate reliable exploitation with no victim interaction once that foothold exists. No EPSS score, KEV listing, or public POC was provided in the input, so there is no signal of active or widespread exploitation; this should be treated as no public exploit identified at time of analysis. Note a mild tension between the CWE and the CVSS impact: CWE-125 (out-of-bounds read) and the 'Information Disclosure' tag point primarily at a memory-read/confidentiality issue, yet Microsoft rates I:H and A:H as well - common for kernel OOB reads that are chained into fuller privilege escalation but worth verifying against the MSRC advisory. Realistically this is a moderate-priority, standard monthly-patch item: dangerous as a post-compromise escalation primitive, but not a remote or wormable threat, and it ranks below any network-facing RCE for emergency patching.

A low-privileged user or malware already running on a Windows host invokes the Storage Spaces driver through a crafted IOCTL or storage operation that triggers the out-of-bounds read in Spaceport.sys. The leaked kernel memory (and the associated memory-safety defect) is used to defeat mitigations and escalate from a standard user account to SYSTEM. No public exploit code was identified in the provided data, and exploitation requires prior local access.