Windows Spaceport.sys EUVD-2026-73658

Physical access to the target machine is the sole hard prerequisite - the attacker must be able to connect a storage device (USB, SATA, NVMe, or similar) to the system. No prior OS authentication or user account is required, as the vulnerable code path is triggered by the kernel's hardware enumeration routines at device plug-in time, before any credential check. No special Windows feature needs to be enabled beyond the default presence of Spaceport.sys, which loads by default on systems using or capable of using Storage Spaces. Exploitation is limited by: (1) mandatory physical proximity to the device, (2) the requirement that the system be powered on and running a vulnerable Spaceport.sys build, and (3) the absence of physical port lockdown controls.

The provided CVSS 6.8 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately reflects the physical-access requirement, which is the dominant risk-limiting factor. Despite the maximum C/H/I/A impact - consistent with kernel-level code execution - real-world exploitation is constrained to scenarios where an adversary can connect a crafted storage device to the target machine. This maps to classic evil-maid and supply-chain attack scenarios. No EPSS data was provided, and the CVE is not listed in CISA KEV, indicating no confirmed widespread exploitation. POC status is unknown. The scope of affected products (Windows 10/11 and Windows Server 2012-2025) is extremely broad, meaning every unpatched Windows endpoint is theoretically in scope once physical access is obtained. The physical barrier significantly reduces opportunistic exploitation probability but does not eliminate targeted threat actor risk, particularly for high-value unattended systems such as kiosks, servers in co-location facilities, or systems accessible in shared office environments.

An attacker with brief unattended physical access - for example, during an office intrusion, at a co-located data center, or targeting a kiosk - connects a crafted USB or storage device with maliciously constructed on-disk metadata. Windows automatically initiates device enumeration, triggering Spaceport.sys to parse the device metadata and overflow a kernel heap buffer. No public exploit code for this specific vulnerability has been identified at time of analysis, but the technique is well-established in kernel driver research.