Windows Spaceport.sys EUVD-2026-99599

Exploitation requires the attacker to already have local, authenticated access with the ability to run code as a low-privileged user (PR:L) on a host where the Spaceport.sys Storage Spaces driver is present and loaded - which is the default on all affected Windows 11 (23H2 through 26H2), Windows Server 2022, and Windows Server 2025 builds below the patched revisions (e.g., Windows Server 2022 <10.0.20348.5761, Windows 11 24H2 <10.0.26100.9711). No user interaction and no network access are needed (UI:N, AV:L), and scope is unchanged (S:U). Limiting factors: the attacker must first obtain local execution (no remote vector), must hold a valid account, and the issue is not automatable per SSVC; applying the available vendor update to the fixed build fully removes the condition.

This is a credible but moderate-priority local privilege escalation. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) describes a locally-executed, low-complexity attack requiring an attacker who is already an authenticated, low-privileged user on the host - not a remote or unauthenticated threat. The 7.8 'High' score is driven by the total impact (C:H/I:H/A:H), consistent with the SSVC 'Technical Impact: total' judgment, since Spaceport.sys runs in kernel mode and successful exploitation yields SYSTEM-level control. However, the exploitation-likelihood signals are uniformly low: SSVC records Exploitation 'none' and Automatable 'no', the input provides no EPSS score, there is no CISA KEV listing, and no public POC is referenced - mapping to 'no public exploit identified at time of analysis.' The combination of total technical impact but no observed exploitation and non-automatable delivery means this is a patch-in-normal-cycle issue rather than an emergency, though it is a valuable post-compromise escalation primitive and should be prioritized on multi-user, shared, or terminal-server hosts. Note a minor metadata conflict: the CWE is CWE-20 (improper input validation) and the description specifies an integer overflow/wraparound, yet the input Tags label it 'Buffer Overflow' - the underlying weakness is an integer wrap, which may or may not lead to a buffer overflow; verify the exact corruption primitive with Microsoft's MSRC advisory.

A low-privileged local user (or malware already running in a standard user context) invokes the vulnerable Storage Spaces driver code path with crafted input that triggers an integer overflow/wraparound in Spaceport.sys, corrupting kernel memory to escalate to SYSTEM. Because the CVSS vector is AV:L/AC:L/PR:L/UI:N, no user interaction or remote access is needed, but the attacker must first have local code execution. No public exploit code is referenced at the time of analysis.