Windows Spaceport EUVD-2026-73536

Exploitation requires a low-privilege authenticated session on the target Windows system (PR:L), achievable via any local interactive logon, RDP session, SSH shell, or similar mechanism. The attacker must be able to interact with the Spaceport.sys driver, which is loaded by default on all supported Windows versions that include Storage Spaces - no non-default configuration or special feature flag is required. Attack complexity is low (AC:L), meaning no race condition or heap-grooming precision is required beyond what a standard exploit would provide. No user interaction is needed after the attacker establishes their session. Exploitation is limited to local access only (AV:L) - network-remote unauthenticated exploitation is not possible directly against this driver.

The CVSS base score of 7.8 accurately reflects a local, low-privilege, low-complexity kernel LPE. Realistic risk is high for any environment where untrusted or semi-trusted local users exist - shared workstations, VDI farms, jump servers, and Windows-based servers with shell access are the primary exposure. EPSS data is absent from the provided intelligence, so exploitation probability cannot be quantified statistically; however, the AC:L/PR:L profile means an attacker who already has any local foothold (e.g., via phishing or credential theft) can reliably escalate - this class of bug routinely appears in post-exploitation chains. KEV status is not confirmed at time of analysis, so exploitation should be treated as probable but not confirmed. The breadth of affected Windows versions (Win10 21H2 through Win11 26H1, Server 2022 and 2025) expands the attack surface considerably. No special software configuration is required beyond having Spaceport.sys loaded, which is the default on modern Windows.

An attacker who has gained a low-privilege shell on a Windows system - through phishing, credential stuffing, or an initial-access vulnerability - submits a specially crafted request to the Spaceport.sys kernel driver that triggers a numeric truncation, causing a heap buffer overflow in kernel pool memory. By overwriting a kernel token or function pointer, the attacker redirects execution and spawns a SYSTEM-level process, achieving full local compromise and enabling credential dumping, lateral movement, or ransomware deployment. No public exploit code has been identified at time of analysis.