Windows Spaceport.sys EUVD-2026-73575

Exploitation requires (1) network access to a Windows host exposing Storage Spaces-related interfaces (e.g., iSCSI target, SMB Direct, or Cluster Shared Volume endpoints), (2) a low-privileged authenticated session on that network - PR:L confirms anonymous exploitation is not possible, and (3) some user or system interaction (UI:R) that traverses the vulnerable Spaceport.sys code path, such as mounting or accessing a remote storage resource. Limiting factors: the attacker cannot exploit this without valid network credentials; fully isolated hosts with Storage Spaces disabled or with network storage protocols blocked at the firewall are not reachable; Windows 10 consumer endpoints that do not expose remote storage services over the network reduce exposure significantly compared to Windows Server deployments running Failover Clustering or iSCSI targets.

The CVSS 8.0 (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) accurately reflects high real-world risk: network reachability (AV:N) combined with low-privilege authentication and a kernel heap overflow producing full CIA impact is a serious combination for any Windows Server environment using networked storage. AC:L indicates no special race conditions or unusual configurations are needed beyond having the vulnerable service reachable. The UI:R constraint moderately limits opportunistic exploitation - an attacker typically cannot fire-and-forget without some degree of user or system interaction triggering the vulnerable code path. No CISA KEV listing and no confirmed public exploit code reduce immediate prioritization urgency compared to a weaponized vulnerability; however, given the breadth of affected Windows versions (Server 2012-2025 and Windows 10/11) and Microsoft's history of Storage Spaces CVEs being targeted post-patch via diffing, patching should be treated as high priority in any environment with network-accessible Storage Spaces or Cluster Shared Volumes. EPSS data is absent from available input - likelihood of broad exploitation cannot be quantified from available signals.

An attacker with low-privileged domain credentials on a network segment where Windows Storage Spaces or Cluster Shared Volume endpoints are accessible sends a specially crafted storage protocol request designed to overflow a heap buffer in Spaceport.sys. Once the kernel heap is corrupted, the attacker redirects execution to shellcode running at ring 0, escalating from a restricted user account to SYSTEM-level privileges on the target Windows host. No public exploit code has been identified at time of analysis, but the straightforward AC:L rating indicates the trigger does not require unusual timing or environmental conditions.