Windows Spaceport.sys EUVD-2026-72960

Exploitation requires an authenticated local session with at least low-privilege (standard user) access on a vulnerable Windows system; no administrator or elevated rights are needed. The attack targets the Spaceport.sys kernel driver directly and does not require any special system configuration or non-default feature enablement beyond the driver being present, which it is by default across all affected Windows editions. No network access is required - the attack vector is strictly local. Exploitation is limited by the requirement for physical or remote desktop access to a local session; internet-facing exploitation is not possible without a prior foothold.

The real-world priority for this vulnerability is moderate. The CVSS 5.5 mid-range score is consistent with the local-only attack vector and pure information-disclosure impact - there is no code-execution or denial-of-service component. EPSS data is not present in the available intelligence, and the flaw is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. The primary risk is that kernel memory disclosure can serve as a stepping stone in a multi-stage local privilege escalation chain, where an attacker first uses leaked kernel addresses or secrets to defeat ASLR or locate sensitive structures before exploiting a separate elevation primitive; even a mid-sized IT operation running unpatched Windows 10/11 endpoints should treat this as a standard Patch Tuesday priority rather than an emergency. The absence of a public exploit and the requirement for an already-authenticated local session meaningfully limit real-world attack surface compared to network-exploitable issues.

A locally authenticated standard user on a Windows 10 or 11 workstation sends a specially crafted request to the Spaceport.sys driver interface, triggering the out-of-bounds read and receiving kernel memory contents in the response buffer. The attacker extracts kernel object addresses or sensitive data from the disclosed memory, using them to defeat KASLR in preparation for a separate local privilege escalation exploit. No public proof-of-concept code is currently known.