Storage Spaces Controller EUVD-2026-73120

Exploitation requires the attacker to hold a low-privilege local user account on the target Windows system (PR:L, AV:L) - remote unauthenticated exploitation is not possible. The Windows Storage Spaces Controller is a default Windows component present on all affected versions regardless of Storage Spaces feature use, so no special feature enablement or non-default configuration is required. Attack complexity is rated Low (AC:L), meaning no race conditions, specific timing, or precondition setup beyond obtaining a local foothold is necessary. Exploitation is bounded by the requirement for existing local code execution rights: an attacker who has only network access and no local account cannot directly exploit this vulnerability.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scoring 7.8 accurately reflects a local privilege escalation requiring only a low-privilege account and no user interaction, delivering full confidentiality, integrity, and availability impact. The unchanged scope (S:U) indicates the direct impact is limited to the compromised host, though SYSTEM-level code execution on a domain-joined system creates meaningful secondary risk for lateral movement and credential harvesting. No EPSS data was included in the provided intelligence, and absence from CISA KEV means active exploitation is unconfirmed at time of analysis. Despite the bounded CVSS scope, the near-universal Windows version coverage means virtually every patched-but-not-yet-updated Windows environment is exposed, and the AC:L rating signals that exploitation does not require race conditions or unusual preconditions beyond local access - a factor that any organization managing shared-access Windows systems (RDP, VDI, terminal servers) should weigh carefully. Heap overflows in Windows kernel drivers are a well-practiced exploitation class with multiple public precedents, suggesting a skilled attacker could develop reliable exploit code even without a published PoC.

An attacker with an existing low-privilege Windows account - for example, a standard domain user on a shared RDP server or a compromised service account - submits a malformed request to the Storage Spaces Controller kernel driver, triggering the heap-based buffer overflow. The overflow corrupts kernel heap metadata or control structures, redirecting execution to attacker-controlled code running in kernel context and yielding SYSTEM-level privileges on the local machine. No public proof-of-concept exploit has been identified at time of analysis, but the Low attack complexity rating indicates reliable exploitation does not require non-standard conditions.