Windows Spaceport.sys EUVD-2026-73607

Exploitation requires a locally authenticated account with at least standard user privileges (PR:L) - no administrative rights are needed. The AV:L vector confirms this is strictly a local attack; remote exploitation is not applicable. AC:H indicates a non-trivial triggering condition, likely requiring a specific memory state, race condition, or particular Storage Spaces configuration on the target system. There is no user interaction requirement (UI:N). The attack does not cross privilege boundaries (S:U). Limiting factors: remote network attackers cannot exploit this directly; unauthenticated users cannot exploit it; and the high complexity means it is unlikely to be reliably exploited without significant effort or local reconnaissance. The vulnerability is most meaningful in shared or multi-user Windows environments where untrusted local users exist.

The CVSS base score of 4.7 accurately reflects the limited real-world risk profile. Attack vector is strictly local (AV:L), requires a low-privileged authenticated user (PR:L), and carries high complexity (AC:H), meaning exploitation is not trivial or automatable. The confidentiality impact is rated high (C:H), suggesting that if successfully triggered, the OOB read could expose meaningful kernel memory (e.g., pointers, credentials, or cryptographic material held in kernel space). However, EPSS data is not provided, no KEV listing exists, and no public POC is known. The exploitability is further constrained by AC:H - this is not a push-button exploit. Real-world priority should be moderate: patch during normal cycles, but no emergency response is warranted absent evidence of targeted exploitation. The tag 'Buffer Overflow' (CWE-120) is a mislabel - the actual weakness is an out-of-bounds read (CWE-125), which is read-only and does not enable memory corruption or code execution.

A low-privileged local user on a multi-tenant Windows Server 2022 system (e.g., a shared RDS host) crafts a sequence of IOCTLs to Spaceport.sys that, under specific memory layout conditions, triggers the out-of-bounds read in the Storage Spaces port driver. The read leaks a slice of kernel memory back to user space - potentially exposing kernel pointers, authentication tokens, or other sensitive data held in adjacent allocations. No public POC exists, and the AC:H requirement means reliable exploitation requires overcoming memory layout uncertainty, likely through a heap-shaping pre-step.