Storage Port Driver EUVD-2026-73264

Exploitation requires an authenticated local user session on an affected Windows host - the CVSS PR:L metric confirms at least a standard (non-guest) user account is needed to submit IOCTL requests to the Storage Port Driver. No user interaction by a second party is required (UI:N), and no special non-default configuration is needed; the Storage Port Driver is loaded by default on all affected Windows versions whenever block storage devices are present. The attack vector is strictly local (AV:L), ruling out remote unauthenticated exploitation. The limiting factor is therefore physical or remote desktop access with valid credentials - privileged or administrative rights are not required, but an account capable of interacting with kernel IOCTL interfaces is.

The CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the local, non-remote nature of this flaw: an attacker must already have authenticated local access with at least a standard user account. The C:H rating elevates real-world concern because kernel memory disclosure can defeat KASLR, providing the address primitives necessary for chaining with a separate write primitive to achieve full privilege escalation - even a modest IT environment with many shared workstations should assess exposure across all affected Windows build lines and prioritize patching based on user-accessible systems. The absence of a KEV listing and no identified public exploit code keeps the urgency at moderate rather than critical; however, the low attack complexity (AC:L) and absence of required user interaction (UI:N) mean exploitation is straightforward once local access is obtained. The wide affected version range - including end-of-mainstream-support products like Server 2012 and 2012 R2 - is a compounding factor for environments that have not fully migrated, since those platforms receive security-only updates under extended support arrangements and may have longer patch deployment cycles.

A low-privileged user logged into a Windows endpoint or terminal server crafts an IOCTL request directed at the Storage Port Driver that causes the kernel to perform an out-of-bounds read, returning controlled kernel memory bytes to the calling process. The attacker extracts kernel pointer values from the leaked data to compute the runtime base address of kernel modules, bypassing KASLR, and then uses that information as a stepping stone in a chained exploit targeting a separate kernel write primitive for full privilege escalation. No public exploit code for this specific flaw has been identified at time of analysis.