Windows Spaceport.sys EUVD-2026-73537

Exploitation requires an authenticated low-privileged local account on the targeted Windows system - CVSS PR:L confirms a standard user is sufficient, and PR:N (unauthenticated) remote exploitation is not possible per the AV:L vector. No special Storage Spaces configuration or enabled feature is described as a prerequisite; Spaceport.sys loads by default on all affected Windows builds regardless of whether Storage Spaces pools are actively configured. No user interaction is required (UI:N). The attack is constrained to the local system boundary. Limiting factors: attackers must already have local code execution as a standard user, ruling out purely remote exploitation vectors.

The CVSS 7.8 score with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H accurately reflects a high-impact local privilege escalation: a low-privileged user account is the only prerequisite, attack complexity is low, and the outcome is full kernel-level code execution. The unusually broad affected surface - spanning end-of-support Server 2012 through current Windows 11 26H1 - means that any organization running unpatched Windows, from large enterprise to smaller operations, faces exposure. EPSS data was not provided and KEV status is absent, suggesting no confirmed widespread exploitation at time of analysis; however, the AC:L rating means this class of flaw is frequently achievable once a researcher has local access, making it a credible post-compromise privilege escalation tool in multi-stage attack chains. The CVSS vector and description are consistent with one another - no conflicting signal between stated impact and metric choices was identified.

An attacker who has compromised a low-privileged domain user account, or malware executing in a standard user context after initial access, submits a crafted IOCTL to the Spaceport.sys driver. The out-of-bounds read leaks kernel memory contents, revealing randomized address layout; the attacker chains this with a control-flow hijack to redirect kernel execution, obtaining SYSTEM-level privileges on the machine. No public exploit code has been identified at time of analysis.