Windows Spaceport.sys EUVD-2026-73485

Attacker must hold at minimum a low-privileged authenticated account on the target system (PR:L per CVSS). Some user interaction is required (UI:R), though the description does not specify its exact form - this is inferred solely from the CVSS vector. The flaw is exploitable over the network (AV:N) with low attack complexity (AC:L) against default Windows configurations containing the unpatched Spaceport.sys driver. Impact is read-only: no write or execution primitive is present. Exploitation is limited by the authentication requirement (no anonymous/unauthenticated path confirmed) and the user-interaction dependency.

The CVSS 5.7 Medium score accurately reflects the meaningful access prerequisites: authentication at low privilege (PR:L) and user interaction (UI:R) both constrain opportunistic exploitation. The high confidentiality impact (C:H) is credible for a kernel-driver OOB read - kernel memory contents can be highly sensitive - but integrity and availability are unaffected (I:N/A:N). No EPSS score was provided in the input data, so probability-based prioritization cannot be applied. The vulnerability has not appeared in CISA KEV, and no public exploit code has been identified, further reducing near-term operational risk. The primary concern is breadth: virtually every supported Windows build across client and server is within the affected version ranges, making patch deployment logistics the dominant risk factor for large organizations.

An attacker with a valid low-privileged domain or local account crafts a network request that triggers an out-of-bounds read in Spaceport.sys, contingent on some form of user interaction - for example, a user opening a crafted file or resource that causes the driver to process attacker-controlled input. The driver reads memory beyond its allocated buffer and returns kernel memory contents to the attacker, which could include sensitive data or kernel pointers facilitating further exploitation.