EUVD-2026-73051
GHSA-vqj2-p54q-hhj4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privileged local session
-
DeliveryCraft storage ioctl targeting Spaceport.sys
-
ExploitTrigger out-of-bounds read in kernel driver
-
ExecutionLeak adjacent kernel memory to user space
-
PersistExtract kernel pointers/canaries
-
ImpactLeverage as KASLR-bypass for privilege escalation
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires a valid local user session - either physical console access or a Remote Desktop session - on an unpatched Windows host within the affected build ranges. PR:L in the CVSS vector confirms a standard (non-administrator) Windows account suffices; no elevated privileges are needed. The vulnerability is limited to the local attack vector (AV:L): network-remote unauthenticated exploitation is not possible without first obtaining a user-level session on the target. No Storage Spaces-specific configuration is mentioned as a prerequisite in the advisory; the driver is present across default Windows installations whether or not Storage Spaces pools are configured. Impact is confidentiality-only: the read primitive does not by itself modify data or cause denial of service. |
| Impact | CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects a local information-disclosure class bug: real-world exploitation requires an interactive or remote-desktop session as a standard (non-admin) user, with no complexity or user-interaction requirement beyond that. No KEV listing and no public exploit code exists at time of analysis, keeping practical risk contained. EPSS data was not supplied; given the local-only vector and Windows patch cadence, widespread opportunistic exploitation is unlikely. The C:H rating is technically correct - kernel OOB reads can leak high-value memory - but without a write primitive the vulnerability does not independently enable privilege escalation or code execution. The primary threat model is a low-privileged insider or a post-compromise attacker seeking to leak kernel pointers to assist a separate privilege-escalation chain. |
| Exploit ScenarioDerived | A low-privileged domain user with an RDP session on a Windows Server 2025 host (build below 10.0.26100.33438) invokes a crafted ioctl or storage API call that triggers an out-of-bounds read in Spaceport.sys, causing the driver to return adjacent kernel memory contents to user space. The attacker parses the leaked data for kernel base addresses or stack canary values, using them to defeat KASLR as a stepping stone in a multi-stage privilege-escalation chain. No public proof-of-concept exists at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Out-of-bounds read in Windows Spaceport.sys (the kernel-mode Storage Spaces port driver) enables a locally authenticated, low-privileged attacker to disclose kernel memory contents. The flaw spans Windows 10, Windows 11, Windows Server 2022, and Windows Server 2025 across multiple feature-update channels. Microsoft has released patches in the July 2026 cumulative update cycle; no public exploit or active exploitation has been identified at time of analysis.
RemediationAI
Apply Microsoft's July 2026 cumulative update, which raises each affected build to its respective fixed version: Windows 10 21H2/22H2 → 10.0.19044.7725/10.0.19045.7725, Windows 11 23H2 → 10.0.22631.7582, Windows 11 24H2/25H2 → 10.0.26100.9445/10.0.26200.9445, Windows 11 26H1 → 10.0.28000.2954, Windows Server 2022 → 10.0.20348.5622, Windows Server 2025 → 10.0.26100.33438. Updates are available via Windows Update, WSUS, and the Microsoft Update Catalog. Where patching is temporarily infeasible, restricting interactive local logon and Remote Desktop access to the minimum required set of accounts reduces the attack surface, since exploitation requires a low-privileged local session. Blocking Storage Spaces driver loading is not a practical workaround on systems relying on virtual disk configurations. Consult the Microsoft Security Response Center advisory for official guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 9 packages in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Spaceport.sys is the Windows kernel-mode driver implementing the Storage Spaces virtualization layer, sitting between the storage class driver and underlying physical/virtual disk devices. CWE-125 (Out-of-bounds Read) indicates the driver reads beyond an allocated memory buffer - a classic kernel read primitive that can leak adjacent kernel memory, stack canaries, heap metadata, or pointer values. On Windows, such reads in a kernel driver operate in ring-0 context, making kernel ASLR bypass a plausible secondary consequence. Affected CPE instances span Windows 10 21H2/22H2 (10.0.19044/19045), Windows 11 23H2/24H2/25H2/26H1 (10.0.22631/26100/26200/28000), Windows Server 2022 (10.0.20348), and Windows Server 2025 (10.0.26100), all below their respective patch build numbers listed in the EUVD advisory.
Know when Windows 10 21h2 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Local vector (AV:L) and low-privilege (PR:L) match 'authorized attacker locally'; OOB read produces C:H with no integrity or availability impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to disclose information locally.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Windows 10 21h2
View all<p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged fi
Windows MSDT (Microsoft Support Diagnostic Tool) allows remote code execution when called via the ms-msdt URL protocol f
Windows Search Remote Code Execution Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely explo
Internet Shortcut Files Security Feature Bypass Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is rem
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Windows Kernel contains a TOCTOU race condition vulnerability allowing local privilege escalation, exploited by the OilR
Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack co
Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is l
Exploit-DB