Windows SCSI Driver EUVD-2026-73807

Physical access to the target machine is mandatory - the AV:P vector rules out any remote or network-based exploitation path. An attacker must be able to connect a crafted SCSI-class storage device directly to the target hardware. No authentication or special privilege level is required once physical access is achieved (PR:N). No user interaction is needed beyond the device attachment. Exploitation is limited by: (1) physical proximity requirement eliminates remote threat actors; (2) impact is read-only - no code execution, no data modification; (3) the specific SCSI device response pattern needed to trigger the boundary violation is not publicly documented. Systems in locked data centres, kiosks with port covers, or environments with strict physical security policies carry substantially lower residual risk than unattended or publicly accessible machines.

The CVSS 3.1 vector CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yields a base score of 4.6, which accurately reflects the physical access prerequisite that fundamentally constrains real-world risk. Remote exploitation is not possible; an attacker must have direct hardware access to the target machine, limiting the threat to scenarios involving physical proximity - unattended workstations, data-center insider access, or supply-chain device tampering. The C:H rating indicates that, once physical access is established, kernel memory disclosure can be significant, potentially exposing sensitive in-memory credentials or cryptographic material. No EPSS data was provided and the vulnerability does not appear in CISA KEV, so widespread automated exploitation is not a current concern. No public proof-of-concept has been identified at time of analysis. The practical priority is patch deployment on systems in physically accessible environments such as public kiosks, shared workstations, or co-located servers, while isolated or locked-down systems represent negligible residual risk until patched.

An attacker with physical access to an unattended Windows machine plugs in a crafted SCSI or USB-to-SCSI storage device that returns malformed SCSI response data designed to trigger the out-of-bounds read in the SCSI Class System File driver. The driver reads beyond the intended buffer boundary, leaking adjacent kernel memory contents - potentially including in-memory credentials, encryption keys, or other sensitive data - which the attacker captures via the device or a local diagnostic tool. No public proof-of-concept has been identified, and no active exploitation is confirmed.