Windows Storage Port Driver EUVD-2026-73348

Exploitation requires an authenticated local session on the target Windows system with at least low-privilege (standard user) rights - confirmed by CVSS PR:L and AV:L. No network access is needed; the attacker must be able to submit IOCTLs to the Storage Port Driver, which is available to all authenticated local users by default on Windows. No special configuration, non-default service, or elevated privilege is required beyond local logon. Exploitation is limited by the local-access requirement: remote unauthenticated attackers cannot trigger the flaw directly. The vulnerability does not affect integrity or availability; the sole impact is kernel memory disclosure (C:H), making it most dangerous as a component of a multi-stage exploit chain rather than a standalone attack.

The CVSS 5.5 (medium) score accurately reflects the constrained exploitation conditions: the attacker must already have local, authenticated access (PR:L, AV:L), limiting remote exploitation paths. The high confidentiality impact (C:H) is notable because kernel memory disclosure in a storage driver context can reveal KASLR base addresses, enabling ASLR bypass as a stepping stone in a multi-stage local privilege escalation chain. No EPSS score was provided in the input data; absence of KEV listing and no reported POC suggests exploitation is not currently widespread. However, the extremely broad affected product surface - from Windows Server 2012 to Windows 11 26H1 and Windows Server 2025 - means the potential target pool is very large. Real-world prioritization should weight the local-access prerequisite heavily: this is not a standalone critical threat but becomes dangerous when chained with other local exploits.

A low-privileged user already logged into a Windows system - or a service account with local logon rights - submits a crafted IOCTL request to the Storage Port Driver with a malformed buffer length or offset parameter. The driver reads kernel memory beyond the intended buffer boundary, and the attacker retrieves the leaked data (e.g., kernel pointer values or adjacent structure contents) via the returned buffer, enabling KASLR defeat for use in a follow-on privilege escalation exploit. No public proof-of-concept has been identified at time of analysis.