Windows Storage Spaces Direct EUVD-2026-43980

Storage Spaces Direct must be enabled and operational on the target system - this is a Windows Server hyperconverged infrastructure feature not active in default Windows 10/11 workstation or standard server configurations, requiring explicit administrator configuration. The attacker must have physical access to the hardware (CVSS AV:P confirmed); remote or network-based exploitation is definitively excluded by the vector. Once physical access is achieved, no prior authentication or elevated privileges are required (PR:N per CVSS), and no user interaction is needed (UI:N). Exploitation is limited by: the physical access requirement eliminating remote and automated attack paths; the need for Storage Spaces Direct to be configured and active (non-default on most endpoints); and the attacker being physically present, precluded by locked facilities, rack security, or hardware security modules. SSVC 'Automatable: no' confirms mass-exploitation campaigns are not feasible.

The CVSS 6.8 score is appropriately calibrated: the AV:P physical access requirement is the dominant risk suppressor, effectively restricting the realistic threat actor population to insiders, hardware thieves, or adversaries who have already breached physical perimeter controls. SSVC corroborates this - 'Automatable: no' rules out scalable remote campaigns, and 'Exploitation: none' confirms no observed active exploitation. The EPSS of 0.31% at the 23rd percentile is consistent with a physically-gated vulnerability with no public weaponization. The high C/I/A impact and SSVC 'Technical Impact: total' are accurate if the attacker successfully triggers the overflow, but that 'if' requires physical presence. There is no KEV listing and no known proof-of-concept. This is a 'high severity if physically reached, low probability of being reached' scenario - genuine priority only for organizations with physically accessible Windows Server S2D nodes (e.g., colocation facilities, kiosks, field-deployed servers) or high insider threat models. No conflicting signals between sources were identified; the physical vector is consistently stated across CVE description, CVSS, and SSVC.

An insider threat or physically-present adversary with access to a data center rack hosting a Windows Server node running Storage Spaces Direct interacts directly with the system to trigger the integer overflow in the storage subsystem - for example, via a locally attached device or direct console session. The wraparound corrupts a size or allocation value in the kernel, enabling the attacker to overwrite privileged memory structures and escalate from an unauthorized or low-privileged state to SYSTEM-level access. No public proof-of-concept exists at time of analysis, and physical access is a non-negotiable prerequisite that cannot be bypassed remotely.