What is the CVSS score of EUVD-2026-56448?

EUVD-2026-56448 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Windows StorPort are affected by EUVD-2026-56448?

A local privilege escalation vulnerability in the Windows Storage Port Driver (storport.sys) allows authorized low-privilege users to gain SYSTEM-level control, creating a significant risk for any…. A patch is available.

How to fix or mitigate EUVD-2026-56448?

Within 24 hours, identify and inventory all affected Windows systems running vulnerable versions of storport.sys using endpoint detection tools or asset management systems, and enable enhanced monitoring for privilege escalation attempts targeting the driver. Over the next 7 days, implement compensating controls including restricting low-privilege user access to affected systems where operationally feasible, disabling unnecessary storage services that expose storport.sys, and deploying endpoint protection rules to detect abnormal system-level process creation from low-privilege contexts. Within 30 days, establish a vendor monitoring process to track Microsoft advisories for storport.sys patches, conduct a privilege access review to identify and remediate excessive low-privilege user assignments, and prepare a deployment plan for patch application once released.

Windows StorPort EUVD-2026-56448

| CVE-2026-65814 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-08-11 secure@microsoft.com

GHSA-cv8q-w3rf-c5cc

Buffer Overflow Heap Overflow Microsoft Windows 10 1607 Windows 10 1809 Windows 10 21h2 Windows 10 22h2 Windows 11 23h2 Windows 11 24h2 Windows 11 25h2 Windows 11 26h1 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022 Windows Server 2025

7.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Local-only attack via AV:L; PR:L confirmed since standard user account suffices; S:U as overflow remains within the OS trust boundary.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Aug 11, 2026 - 18:19 EUVD

Analysis Generated

Aug 11, 2026 - 18:16 vuln.today

CVE Published

Aug 11, 2026 - 17:19 nvd

HIGH 7.8

DescriptionCVE.org

Heap-based buffer overflow in Windows Storage Port Driver allows an authorized attacker to elevate privileges locally.

AnalysisAI

Local privilege escalation in the Windows Storage Port Driver (storport.sys) exploits a heap-based buffer overflow to allow an authorized low-privilege user to gain SYSTEM-level control of an affected Windows host. The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N) confirms the attack requires only an existing low-privilege local session - no additional permissions or user interaction are needed - with full confidentiality, integrity, and availability impact upon success. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed in CISA KEV.

Technical ContextAI

The Windows Storage Port Driver (storport.sys) is a kernel-mode miniport driver included in all modern Windows operating systems, serving as the interface between Windows storage class drivers and physical or virtual storage adapters. CWE-122 (Heap-based Buffer Overflow) identifies the root cause: a crafted request - most plausibly via a DeviceIoControl IOCTL call directed at the driver - causes the driver to write beyond the bounds of an allocated kernel heap buffer, corrupting adjacent memory. In kernel-mode context, such corruption can enable overwrite of function pointers, security descriptor fields, or object headers, redirecting execution to attacker-controlled code running at ring-0 (kernel) privilege. Because storport.sys is loaded by default as part of the Windows storage stack, no special driver installation or feature enablement is required to expose the vulnerable code path.

RemediationAI

Apply the Microsoft security update for CVE-2026-65814 via Windows Update, Windows Server Update Services (WSUS), or the Microsoft Update Catalog; the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-65814 is the authoritative source for the specific KB article and patched build number, which are not independently confirmed from available input data. As a compensating control where immediate patching is not feasible, restrict local interactive logon and Remote Desktop rights to only explicitly required accounts via Group Policy (User Rights Assignment: Deny log on locally / Deny log on through Remote Desktop Services), reducing the set of accounts that could serve as a launchpad - note this limits exposure but does not eliminate the vulnerability. Additionally, deploy application control policies (Windows Defender Application Control or AppLocker) to prevent unsigned or untrusted binaries from issuing IOCTLs to storage drivers, accepting the operational trade-off that overly restrictive policies may interfere with legitimate storage management tools. Endpoint detection rules should be tuned to alert on unusual kernel driver interactions from low-privilege user-mode processes.